{"id":"CVE-2022-22970","published":"2022-05-12T19:28:47Z","modified":"2026-10-08T21:03:33Z","title":"In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file…","vendor":null,"product":null,"tier":"tail","description":{"text":"In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01962,"percentile":0.80329,"provenance":"source"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"references":[{"url":"https://tanzu.vmware.com/security/cve-2022-22970","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20220616-0006/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":16.1,"factors":[{"name":"EPSS percentile","points":16.07}]},"affectedVersions":[{"vendor":"n/a","product":"Spring Framework","versions":["Spring Framework versions 5.3.x prior to 5.3.20, 5.2.x prior to 5.2.22 and all old and unsupported versions"]}],"affected":[{"ecosystem":"Maven","package":"org.springframework:spring-beans","vulnerableRanges":["<5.2.22.RELEASE",">=5.3.0, <5.3.20"],"patched":["5.2.22.RELEASE","5.3.20"],"from":["GHSA-hh26-6xwr-ggv7"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4149","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-22965","published":"2022-04-01","fixed":"5.3.18","kev":true,"link":{"from":"CVE-2022-22965","to":"CVE-2022-22970","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.springframework:spring-beans","fromFixed":"5.2.20.RELEASE","toFixed":"5.2.22.RELEASE","daysApart":41}]}},{"cve":"CVE-2022-22970","published":"2022-05-12","fixed":"5.3.20","kev":false}],"package":"Maven:org.springframework:spring-beans"}}