CVE-2021-22112
Privilege escalation in spring security
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
- Record
CVE-2021-22112- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.0 High
AV:N/AC:L/Au:S/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
- Record
CVE-2021-22112- Updated
- 2026-11-02
EUVDEUVD-2021-1083 No score
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
- Record
EUVD-2021-1083- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gq28-h5vg-8prx
Privilege escalation in spring security
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
- Record
GHSA-gq28-h5vg-8prx- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
OSV
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
- Record
CVE-2021-22112- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-gq28-h5vg-8prx
Privilege escalation in spring security
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leveraged to extend those privileges to the rest of the application.
- Record
GHSA-gq28-h5vg-8prx- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1773015254 No score
TuxCare security update for org.springframework.security (5 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.1.
- Record
CLSA-2026-1773015254- Updated
- 2026-11-02
OSVCLSA-2026-1775694713 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 4.2.12.RELEASE-tuxcare.1.
- Record
CLSA-2026-1775694713- Updated
- 2026-11-02
OSVCLSA-2026-1792503291 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792503291- Updated
- 2026-11-02
OSVCLSA-2026-1792588191 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792588191- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2021-22112 No score
CVE-2021-22112 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2021-22112 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2021-22112- Updated
- 2026-11-02
Affected products
- pivotal software spring security
- spring security
- vmware spring security
- oracle communications element manager
- oracle communications interactive session recorder
- oracle communications unified inventory management
- oracle hospitality cruise shipboard property management system
- oracle insurance policy administration
- oracle mysql enterprise monitor
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-webMaven |
before 5.2.9 | 5.2.9 |
org.springframework.security:spring-security-bomMaven |
5.4.0 up to 5.4.4 | 5.4.4 |
org.springframework.security:spring-security-bomMaven |
5.3.0 up to 5.3.8 | 5.3.8 |
org.springframework.security:spring-security-bomMaven |
before 5.2.9 | 5.2.9 |
org.springframework.security:spring-security-webMaven |
5.4.0 up to 5.4.4 | 5.4.4 |
org.springframework.security:spring-security-webMaven |
5.3.0 up to 5.3.8 | 5.3.8 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
Show 25 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-casTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-casTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-bomMaven |
5.4.0 up to 5.4.4, plus listed versions 5.4.15.4.25.4.3 |
5.4.4 |
org.springframework.security:spring-security-bomMaven |
5.3.0 up to 5.3.8, plus listed versions 5.3.0.RELEASE5.3.1.RELEASE5.3.2.RELEASE5.3.3.RELEASE5.3.4.RELEASE5.3.5.RELEASE5.3.6.RELEASE5.3.7.RELEASE |
5.3.8 |
org.springframework.security:spring-security-bomMaven |
before 5.2.9, plus listed versions 3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE Show 45 moreShow less3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE4.2.19.RELEASE4.2.2.RELEASE4.2.20.RELEASE4.2.3.RELEASE4.2.4.RELEASE4.2.5.RELEASE4.2.6.RELEASE4.2.7.RELEASE4.2.8.RELEASE4.2.9.RELEASE5.0.0.RELEASE5.0.1.RELEASE5.0.10.RELEASE5.0.11.RELEASE5.0.12.RELEASE5.0.13.RELEASE5.0.14.RELEASE |
5.2.9 |
org.springframework.security:spring-security-webMaven |
5.4.0 up to 5.4.4, plus listed versions 5.4.15.4.25.4.3 |
5.4.4 |
org.springframework.security:spring-security-webMaven |
5.3.0 up to 5.3.8, plus listed versions 5.3.0.RELEASE5.3.1.RELEASE5.3.2.RELEASE5.3.3.RELEASE5.3.4.RELEASE5.3.5.RELEASE5.3.6.RELEASE5.3.7.RELEASE |
5.3.8 |
org.springframework.security:spring-security-webMaven |
before 5.2.9, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE Show 45 moreShow less3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE |
5.2.9 |
org.springframework.security:spring-security-webRoot:Maven |
before 5.2.2.RELEASE-aikido.2 | 5.2.2.RELEASE-aikido.2 |
org.springframework.security:spring-security-coreRoot:Maven |
before 5.2.2.RELEASE-aikido.2 | 5.2.2.RELEASE-aikido.2 |
io.root.org.springframework.security:spring-security-webRoot:Maven |
before 5.2.2.RELEASE-root.io.2 | 5.2.2.RELEASE-root.io.2 |
io.root.org.springframework.security:spring-security-coreRoot:Maven |
before 5.2.2.RELEASE-root.io.2 | 5.2.2.RELEASE-root.io.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22112 is a high vulnerability (CVSS 8.8) in Pivotal Software Spring Security, published February 23, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.29%, the 88th percentile. Fixed in org.springframework.security:spring-security-web 5.2.9.
References
openwall.com/lists/oss-security/2021/02/19/7
lists.apache.org/thread.html/redbd004a503b3520ae5746c2ab5e93fd7da807a8c128e60d2002cd9b%40%3Cissues.nifi.apache.org%3E
oracle.com/security-alerts/cpuApr2021.html
tanzu.vmware.com/security/cve-2021-22112
Show 24 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-22112
github.com/spring-projects/spring-security/releases/tag/5.4.4
jenkins.io/security/advisory/2021-02-19
Left out here: 89 versions. The JSON record has them.