CVE-2021-22060
Log entry injection in Spring Framework
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
- Record
CVE-2021-22060- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
- Record
CVE-2021-22060- Updated
- 2026-11-02
EUVDEUVD-2022-0479 No score
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
- Record
EUVD-2022-0479- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6gf2-pvqw-37ph
Log entry injection in Spring Framework
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
- Record
GHSA-6gf2-pvqw-37ph- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSV
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
- Record
CVE-2021-22060- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-22060
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
- Record
DEBIAN-CVE-2021-22060- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSVGHSA-6gf2-pvqw-37ph
Log entry injection in Spring Framework
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
- Record
GHSA-6gf2-pvqw-37ph- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2021-22060
CVE-2021-22060 in org.springframework:spring-core - Patched by Root
Root has patched CVE-2021-22060 in the org.springframework:spring-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2021-22060- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-22060
In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
- Record
UBUNTU-CVE-2021-22060- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2025-1762906008 No score
TuxCare security update for org.springframework (13 CVEs)
TuxCare rebuilt 10 org.springframework packages to address 13 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.1.
- Record
CLSA-2025-1762906008- Updated
- 2026-11-02
OSVCLSA-2026-1776040412 No score
TuxCare security update for org.springframework (13 CVEs)
TuxCare rebuilt 8 org.springframework packages to address 13 CVEs. Fixed in 5.3.7-tuxcare.2.
- Record
CLSA-2026-1776040412- Updated
- 2026-11-02
OSVCLSA-2026-1777336766 No score
TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 3 org.springframework packages to address 4 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.4.
- Record
CLSA-2026-1777336766- Updated
- 2026-11-02
OSVCLSA-2026-1779151623 No score
TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.3.
- Record
CLSA-2026-1779151623- Updated
- 2026-11-02
OSVCLSA-2026-1791463722 No score
TuxCare security update for org.springframework (20 CVEs)
TuxCare rebuilt 8 org.springframework packages to address 20 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.4.
- Record
CLSA-2026-1791463722- Updated
- 2026-11-02
OSVCLSA-2026-1791532205 No score
TuxCare security update for org.springframework (17 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 17 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.4.
- Record
CLSA-2026-1791532205- Updated
- 2026-11-02
OSVCLSA-2026-1792600686 No score
TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 3 CVEs. Fixed in 5.3.13-tuxcare.2.
- Record
CLSA-2026-1792600686- Updated
- 2026-11-02
OSVCLSA-2026-1793884738 No score
TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 8 org.springframework packages to address 14 CVEs. Fixed in 5.3.5-tuxcare.3.
- Record
CLSA-2026-1793884738- Updated
- 2026-11-06
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-coreMaven |
5.3.0 up to 5.3.14 | 5.3.14 |
org.springframework:spring-coreMaven |
5.2.0 up to 5.2.19 | 5.2.19 |
org.springframework:springTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
Show 58 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 13 CVEs |
5.2.0.RELEASE up to 5.2.0.RELEASE-tuxcare.1 | 5.2.0.RELEASE-tuxcare.1 |
org.springframework:springTuxCare:Maven From an advisory covering 13 CVEs |
5.3.7 up to 5.3.7-tuxcare.2, plus listed versions 5.3.7-tuxcare.1 |
5.3.7-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 13 CVEs |
5.3.7 up to 5.3.7-tuxcare.2, plus listed versions 5.3.7-tuxcare.1 |
5.3.7-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 13 CVEs |
5.3.7 up to 5.3.7-tuxcare.2, plus listed versions 5.3.7-tuxcare.1 |
5.3.7-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 13 CVEs |
5.3.7 up to 5.3.7-tuxcare.2, plus listed versions 5.3.7-tuxcare.1 |
5.3.7-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 13 CVEs |
5.3.7 up to 5.3.7-tuxcare.2, plus listed versions 5.3.7-tuxcare.1 |
5.3.7-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 13 CVEs |
5.3.7 up to 5.3.7-tuxcare.2, plus listed versions 5.3.7-tuxcare.1 |
5.3.7-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 13 CVEs |
5.3.7 up to 5.3.7-tuxcare.2, plus listed versions 5.3.7-tuxcare.1 |
5.3.7-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 13 CVEs |
5.3.7 up to 5.3.7-tuxcare.2, plus listed versions 5.3.7-tuxcare.1 |
5.3.7-tuxcare.2 |
org.springframework:springTuxCare:Maven From an advisory covering 4 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.4, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.3 |
5.2.13.RELEASE-tuxcare.4 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 4 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.4, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.3 |
5.2.13.RELEASE-tuxcare.4 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 4 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.4, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.3 |
5.2.13.RELEASE-tuxcare.4 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 2 CVEs |
4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.3, plus listed versions 4.3.30.RELEASE-tuxcare.14.3.30.RELEASE-tuxcare.2 |
4.3.30.RELEASE-tuxcare.3 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 2 CVEs |
4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.3, plus listed versions 4.3.30.RELEASE-tuxcare.14.3.30.RELEASE-tuxcare.2 |
4.3.30.RELEASE-tuxcare.3 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 20 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.4, plus listed versions 4.0.0.RELEASE-tuxcare.14.0.0.RELEASE-tuxcare.24.0.0.RELEASE-tuxcare.3 |
4.0.0.RELEASE-tuxcare.4 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 20 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.4, plus listed versions 4.0.0.RELEASE-tuxcare.14.0.0.RELEASE-tuxcare.24.0.0.RELEASE-tuxcare.3 |
4.0.0.RELEASE-tuxcare.4 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 20 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.4, plus listed versions 4.0.0.RELEASE-tuxcare.14.0.0.RELEASE-tuxcare.24.0.0.RELEASE-tuxcare.3 |
4.0.0.RELEASE-tuxcare.4 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 20 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.4, plus listed versions 4.0.0.RELEASE-tuxcare.14.0.0.RELEASE-tuxcare.24.0.0.RELEASE-tuxcare.3 |
4.0.0.RELEASE-tuxcare.4 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 20 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.4, plus listed versions 4.0.0.RELEASE-tuxcare.14.0.0.RELEASE-tuxcare.24.0.0.RELEASE-tuxcare.3 |
4.0.0.RELEASE-tuxcare.4 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 20 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.4, plus listed versions 4.0.0.RELEASE-tuxcare.14.0.0.RELEASE-tuxcare.24.0.0.RELEASE-tuxcare.3 |
4.0.0.RELEASE-tuxcare.4 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 20 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.4, plus listed versions 4.0.0.RELEASE-tuxcare.14.0.0.RELEASE-tuxcare.24.0.0.RELEASE-tuxcare.3 |
4.0.0.RELEASE-tuxcare.4 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 20 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.4, plus listed versions 4.0.0.RELEASE-tuxcare.14.0.0.RELEASE-tuxcare.24.0.0.RELEASE-tuxcare.3 |
4.0.0.RELEASE-tuxcare.4 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 17 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.4, plus listed versions 3.1.1.RELEASE-tuxcare.13.1.1.RELEASE-tuxcare.23.1.1.RELEASE-tuxcare.3 |
3.1.1.RELEASE-tuxcare.4 |
org.springframework:spring-context-supportTuxCare:Maven From an advisory covering 17 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.4, plus listed versions 3.1.1.RELEASE-tuxcare.13.1.1.RELEASE-tuxcare.23.1.1.RELEASE-tuxcare.3 |
3.1.1.RELEASE-tuxcare.4 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 17 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.4, plus listed versions 3.1.1.RELEASE-tuxcare.13.1.1.RELEASE-tuxcare.23.1.1.RELEASE-tuxcare.3 |
3.1.1.RELEASE-tuxcare.4 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 17 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.4, plus listed versions 3.1.1.RELEASE-tuxcare.13.1.1.RELEASE-tuxcare.23.1.1.RELEASE-tuxcare.3 |
3.1.1.RELEASE-tuxcare.4 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 17 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.4, plus listed versions 3.1.1.RELEASE-tuxcare.13.1.1.RELEASE-tuxcare.23.1.1.RELEASE-tuxcare.3 |
3.1.1.RELEASE-tuxcare.4 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 17 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.4, plus listed versions 3.1.1.RELEASE-tuxcare.13.1.1.RELEASE-tuxcare.23.1.1.RELEASE-tuxcare.3 |
3.1.1.RELEASE-tuxcare.4 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 17 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.4, plus listed versions 3.1.1.RELEASE-tuxcare.13.1.1.RELEASE-tuxcare.23.1.1.RELEASE-tuxcare.3 |
3.1.1.RELEASE-tuxcare.4 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 3 CVEs |
5.3.13 up to 5.3.13-tuxcare.2, plus listed versions 5.3.13-tuxcare.1 |
5.3.13-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 3 CVEs |
5.3.13 up to 5.3.13-tuxcare.2, plus listed versions 5.3.13-tuxcare.1 |
5.3.13-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 3 CVEs |
5.3.13 up to 5.3.13-tuxcare.2, plus listed versions 5.3.13-tuxcare.1 |
5.3.13-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 3 CVEs |
5.3.13 up to 5.3.13-tuxcare.2, plus listed versions 5.3.13-tuxcare.1 |
5.3.13-tuxcare.2 |
org.springframework:springTuxCare:Maven From an advisory covering 14 CVEs |
5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2 |
5.3.5-tuxcare.3 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 14 CVEs |
5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2 |
5.3.5-tuxcare.3 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 14 CVEs |
5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2 |
5.3.5-tuxcare.3 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 14 CVEs |
5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2 |
5.3.5-tuxcare.3 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 14 CVEs |
5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2 |
5.3.5-tuxcare.3 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 14 CVEs |
5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2 |
5.3.5-tuxcare.3 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 14 CVEs |
5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2 |
5.3.5-tuxcare.3 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 14 CVEs |
5.3.5 up to 5.3.5-tuxcare.3, plus listed versions 5.3.5-tuxcare.15.3.5-tuxcare.2 |
5.3.5-tuxcare.3 |
libspring-javaDebian:12 |
All versions, plus listed versions 4.3.30-24.3.30-34.3.30-44.3.30-54.3.30-6 |
None known |
libspring-javaDebian:13 |
All versions, plus listed versions 4.3.30-34.3.30-44.3.30-54.3.30-6 |
None known |
libspring-javaDebian:14 |
All versions, plus listed versions 4.3.30-34.3.30-44.3.30-54.3.30-6 |
None known |
org.springframework:spring-coreMaven |
5.3.0 up to 5.3.14, plus listed versions 5.3.15.3.105.3.115.3.125.3.13 Show 8 moreShow less5.3.25.3.35.3.45.3.55.3.65.3.75.3.85.3.9 |
5.3.14 |
org.springframework:spring-coreMaven |
5.2.0 up to 5.2.19, plus listed versions 5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE Show 14 moreShow less5.2.13.RELEASE5.2.14.RELEASE5.2.15.RELEASE5.2.16.RELEASE5.2.17.RELEASE5.2.18.RELEASE5.2.2.RELEASE5.2.3.RELEASE5.2.4.RELEASE5.2.5.RELEASE5.2.6.RELEASE5.2.7.RELEASE5.2.8.RELEASE5.2.9.RELEASE |
5.2.19 |
org.springframework:spring-coreRoot:Maven |
before 5.3.14-aikido.4 | 5.3.14-aikido.45.3.14-aikido.35.3.14-aikido.55.3.14-aikido.65.3.14-aikido.75.3.14-aikido.8 |
io.root.org.springframework:spring-coreRoot:Maven |
before 5.3.14-root.io.4 | 5.3.14-root.io.45.3.14-root.io.35.3.14-root.io.55.3.14-root.io.65.3.14-root.io.75.3.14-root.io.8 |
libspring-javaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2 |
None known |
libspring-javaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.3.11-14.3.12-14.3.13-24.3.14-14.3.22-1~18.044.3.22-1~18.04.1~esm1 |
None known |
libspring-javaUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.3.22-44.3.22-4ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 4.3.30-14.3.30-1ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 4.3.30-24.3.30-2ubuntu0.24.04.1~esm1 |
None known |
libspring-javaUbuntu:25.10 |
All versions, plus listed versions 4.3.30-2ubuntu14.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.10 |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.04:LTS |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22060 is a medium vulnerability (CVSS 4.3) in Vmware Spring Framework, published January 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.91%, the 60th percentile. Fixed in org.springframework:spring-core 5.3.14.