CVE-2022-22971
Fixed upstream EPSS 3%
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
Products: vmware spring_framework, oracle financial_services_crime_and_compliance_management_studio, netapp cloud_secure_agent, netapp oncommand_insight
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.springframework:spring-messaging | 5.3.20 |
| Maven | org.springframework:spring-messaging | 5.2.22.RELEASE |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libspring-java | no fix |
| Debian 13 | libspring-java | no fix |
| Debian 14 | libspring-java | no fix |
| Ubuntu 25.10 | libspring-java | no fix |
| Ubuntu 26.04 LTS | libspring-java | no fix |
| Ubuntu 26.10 | libspring-java | no fix |
| Ubuntu Pro 14.04 LTS | libspring-java | no fix |
| Ubuntu Pro 16.04 LTS | libspring-java | no fix |
| Ubuntu Pro 18.04 LTS | libspring-java | no fix |
| Ubuntu Pro 20.04 LTS | libspring-java | no fix |
| Ubuntu Pro 22.04 LTS | libspring-java | no fix |
| Ubuntu Pro 24.04 LTS | libspring-java | no fix |