Cybersecurity Briefing — Spring4Shell CVE-2022-22965 remote code execution
VMware’s Spring team disclosed CVE-2022-22965 (Spring4Shell) on 31 March 2022, a remote code execution flaw affecting Spring MVC/WebFlux apps on JDK 9+, prompting patch releases and urgent mitigation for Java web workloads.
The Spring maintainers confirmed CVE-2022-22965 on 31 March 2022 after exploit code surfaced, enabling remote code execution on certain Spring MVC or WebFlux applications running on JDK 9 or later. The vulnerability stems from unsafe data binding in the DefaultDataBinder when deployed on Tomcat with specific conditions.
Spring issued patched versions 5.3.18 and 5.2.20 and published mitigations (e.g., setting DisallowedFields) for systems unable to update immediately. Teams were urged to inventory Java services, update to fixed releases, and verify runtime protections against RCE payloads.
- VMware security advisory documents impacted configurations, severity, and recommended upgrades.
- Spring project announcement provides patch versions, workaround guidance, and scope details for administrators.
Continue in the Cybersecurity pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Cybersecurity Operations Playbook — Zeph Tech
Use Zeph Tech research to align NIST CSF 2.0, CISA KEV deadlines, and sector mandates across threat intelligence, exposure management, and incident response teams.