CVE-2022-22965 Spring4Shell: Spring Framework JDK 9+ Remote Code Execution

Exploited in the wild Critical 9.8 Published 1 Apr 2022 Updated 21 Oct 2025

Attackers can achieve remote code execution in Spring MVC or WebFlux applications deployed as WARs on Tomcat with JDK 9+ via unsafe data binding.

Exploited in the wild: Since 4 Apr 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-22965?

CVE-2022-22965 (Spring4Shell) is a critical code injection vulnerability in Oracle Communications Cloud Native Core Automated Test Suite, published on 1 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Weakness: CWE-94

Which versions are affected by CVE-2022-22965?

20 open source packages ship an affected version, including org.springframework.boot:spring-boot-starter-web, org.springframework.boot:spring-boot-starter-webflux and org.springframework:spring-beans. It affects 38 products.

Package	Affected	Fixed in
`org.springframework.boot:spring-boot-starter-web` Maven	All versions	`2.5.12`
`org.springframework.boot:spring-boot-starter-web` Maven	All versions	`2.5.12`
`org.springframework.boot:spring-boot-starter-web` Maven	From `2.6.0`	`2.6.6`
`org.springframework.boot:spring-boot-starter-web` Maven	From `2.6.0`	`2.6.6`
`org.springframework.boot:spring-boot-starter-webflux` Maven	All versions	`2.5.12`
`org.springframework.boot:spring-boot-starter-webflux` Maven	All versions	`2.5.12`

14 more packages

`org.springframework.boot:spring-boot-starter-webflux` Maven	From `2.6.0`	`2.6.6`
`org.springframework.boot:spring-boot-starter-webflux` Maven	From `2.6.0`	`2.6.6`
`org.springframework:spring-beans` Maven	All versions	`5.2.20.RELEASE`
`org.springframework:spring-beans` Maven	All versions	`5.2.20.RELEASE`
`org.springframework:spring-beans` Maven	From `5.3.0`	`5.3.18`
`org.springframework:spring-beans` Maven	From `5.3.0`	`5.3.18`
`org.springframework:spring-webflux` Maven	All versions	`5.2.20.RELEASE`
`org.springframework:spring-webflux` Maven	All versions	`5.2.20.RELEASE`
`org.springframework:spring-webflux` Maven	From `5.3.0`	`5.3.18`
`org.springframework:spring-webflux` Maven	From `5.3.0`	`5.3.18`
`org.springframework:spring-webmvc` Maven	All versions	`5.2.20.RELEASE`
`org.springframework:spring-webmvc` Maven	All versions	`5.2.20.RELEASE`
`org.springframework:spring-webmvc` Maven	From `5.3.0`	`5.3.18`
`org.springframework:spring-webmvc` Maven	From `5.3.0`	`5.3.18`

Products include Cisco Cx Cloud Agent, Oracle Commerce Platform, Oracle Communications Cloud Native Core Automated Test Suite, Oracle Communications Cloud Native Core Binding Support Function, Oracle Communications Cloud Native Core Console, Oracle Communications Cloud Native Core Network Exposure Function and 32 more.

How do I fix CVE-2022-22965?

Upgrade org.springframework.boot:spring-boot-starter-web to a fixed version for your release line: 2.5.12 or 2.6.6. US federal agencies must fix it by 25 Apr 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-22965 being exploited?

Yes. Attackers have exploited CVE-2022-22965 in the wild since at least 4 Apr 2022.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 100 proofs of concept on GitHub.

All Oracle Communications Cloud Native Core Automated Test Suite vulnerabilities

Sources

Also known as CLSA-2025-1758845168, CLSA-2026-1781571260, DEBIAN-CVE-2022-22965, GHSA-36p3-wjmg-h94x, ROOT-APP-MAVEN-CVE-2022-22965, UBUNTU-CVE-2022-22965 and 1 more.