Most recent entries from all

bdu:2022-01627

2026-10-02T10:43:54.695120+00:00

bdu:2022-01627

certfr-2022-avi-279 — Une vulnérabilité a été découverte dans VMware Spring. Elle permet à un attaquant de provoquer un déni de service à dis…

2026-10-02T10:43:54.695152+00:00

certfr-2022-avi-279

cnvd-2022-34640

2026-10-02T10:43:54.695171+00:00

cnvd-2022-34640

EUVD-2026-13596

2026-10-02T10:43:54.695182+00:00

EUVD-2026-13596

fkie_cve-2022-22950

2026-10-02T10:43:54.695193+00:00

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

GHSA-558x-2xjg-6232 — Allocation of Resources Without Limits or Throttling in Spring Framework

2026-10-02T10:43:54.695229+00:00

Affected: Maven: org.springframework:spring-expression

In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0.RELEASE - 5.2.19.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

gsd-2022-22950

2026-10-02T10:43:54.695254+00:00

gsd-2022-22950

ICSA-22-286-05 — Hitachi Energy Lumada Asset Performance Management Prognostic Model Executor Service

2026-10-02T10:43:54.695264+00:00

A vulnerability exists in the Spring Framework component included in the Prognostic Model Executor service of the affected product. An attacker could exploit this vulnerability by sending a specially crafted data or configuration to the application either directly or via integrated applications, causing the Prognostic Model Executor service to fail.CVE-2022-22950 has been assigned to this vulnerability. A CVSS v3 base score of 3.1 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L). A vulnerability in the Spring Framework component included in the Prognostic Model Executor service could allow an attacker to inject arbitrary code for remote code execution.CVE-2022-22965 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

OESA-2025-1557 — springframework security update

2026-10-02T10:43:54.695286+00:00

Affected: openEuler:22.03-LTS-SP3: springframework, openEuler:22.03-LTS-SP4: springframework, openEuler:24.03-LTS: springframework, openEuler:24.03-LTS-SP1: springframework, openEuler:20.03-LTS-SP4: springframework

The spring is based on code pubilshed in Expert One-on-One J2EE Design and Dvelopment by Rod Johnson (Wrox, 2002).it is a layered Java/J2ee application framework. Security Fix(es):

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.(CVE-2022-22950)

RHSA-2022:5532 — Red Hat Security Advisory: Red Hat Fuse 7.11.0 release and security update

2026-10-02T10:43:54.695313+00:00

elasticsearch: not properly preserving security permissions when executing complex queries may lead to information disclosure tomcat: deserialization flaw in session persistence storage leading to RCE junit4: TemporaryFolder is shared between all users across system which could result in information disclosure wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure jackson-databind: denial of service via a large depth of nested objects mysql-connector-java: unauthorized access to critical undertow: potential security issue in flow control over HTTP/2 may lead to DOS wildfly-elytron: possible timing attack in ScramServer wildfly-core: Invalid Sensitivity Classification of Vault Expression nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes undertow: client side invocation timeout raised when calling over HTTP2 kubernetes-client: Insecure deserialization in unmarshalYaml method springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096) springframework: malicious input leads to insertion of additional log entries spring-security: Denial-of-Service (DoS) attack via initiation of Authorization Request protobuf-java: potential DoS in the parsing procedure for binary data google-oauth-client: Token signature not verified tomcat: Inf…

UBUNTU-CVE-2022-22950

2026-10-02T10:43:54.695390+00:00

Affected: Ubuntu:Pro:14.04:LTS: libspring-java, Ubuntu:Pro:16.04:LTS: libspring-java, Ubuntu:Pro:18.04:LTS: libspring-java, Ubuntu:Pro:20.04:LTS: libspring-java, Ubuntu:Pro:22.04:LTS: libspring-java, Ubuntu:Pro:24.04:LTS: libspring-java, Ubuntu:25.10: libspring-java, Ubuntu:26.04:LTS: libspring-java

n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

WID-SEC-W-2022-0607 — Red Hat FUSE: Mehrere Schwachstellen

2026-10-02T10:43:54.695418+00:00

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.