CVE-2022-22971
MEDIUM 6.5EPSS 3.2%
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
- Affected
- Spring Framework
- CVSS v3.1 NVD
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS v2.0 NVD
- 4.0 MEDIUM
AV:N/AC:L/Au:S/C:N/I:N/A:P - EPSS
- 3.17% chance of exploitation in the next 30 days, 88th percentile
- Published
- 2022-05-12
- Updated
- 2026-10-08
Proof-of-concept exploits (1)
- tchize/CVE-2022-229711★ · 2022-11-27
Security advisories
- https://tanzu.vmware.com/security/cve-2022-22971
- https://security.netapp.com/advisory/ntap-20220616-0003
- https://www.oracle.com/security-alerts/cpujul2022.html
- advisories/GHSA-rqph-vqwm-22vc