CVE-2022-22978
Authorization bypass in Spring Security
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
- Record
CVE-2022-22978- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
- Record
CVE-2022-22978- Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2022-4151 No score
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
- Record
EUVD-2022-4151- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hh32-7344-cg2f
Authorization bypass in Spring Security
In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
- Record
GHSA-hh32-7344-cg2f- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-285, CWE-863
- Updated
- 2026-11-02
OSVGHSA-hh32-7344-cg2f
Authorization bypass in Spring Security
In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
- Record
GHSA-hh32-7344-cg2f- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-285, CWE-863
- Updated
- 2026-11-02
OSVRHSA-2023:3299
Red Hat Security Advisory: jenkins and jenkins-2-plugins security update
- Record
RHSA-2023:3299- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 9 moreShow less
OSVUBUNTU-CVE-2022-22978
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
- Record
UBUNTU-CVE-2022-22978- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
OSVCLSA-2026-1773015254 No score
TuxCare security update for org.springframework.security (5 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.1.
- Record
CLSA-2026-1773015254- Updated
- 2026-11-02
OSVCLSA-2026-1775694713 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 4.2.12.RELEASE-tuxcare.1.
- Record
CLSA-2026-1775694713- Updated
- 2026-11-02
OSVCLSA-2026-1792102802 No score
TuxCare security update for org.springframework.security (8 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792102802- Updated
- 2026-11-02
OSVCLSA-2026-1792502421 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 5.1.4.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792502421- Updated
- 2026-11-02
OSVCLSA-2026-1792503291 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792503291- Updated
- 2026-11-02
OSVCLSA-2026-1792588191 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792588191- Updated
- 2026-11-02
OSV No score
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an authorization bypass.
- Record
CVE-2022-22978- Weakness
- CWE-863
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2022-22978 No score
CVE-2022-22978 in org.springframework.security:spring-security-web - Patched by Root
Root has patched CVE-2022-22978 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2022-22978- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-coreMaven |
5.6.0 up to 5.6.4 | 5.6.4 |
org.springframework.security:spring-security-coreMaven |
5.5.0 up to 5.5.7 | 5.5.7 |
org.springframework.security:spring-security-coreMaven |
before 5.4.11 | 5.4.11 |
org.springframework.security:spring-security-webMaven |
5.5.0 up to 5.5.7 | 5.5.7 |
org.springframework.security:spring-security-webMaven |
5.6.0 up to 5.6.4 | 5.6.4 |
org.springframework.security:spring-security-webMaven |
before 5.4.11 | 5.4.11 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 5 CVEs |
4.2.20.RELEASE up to 4.2.20.RELEASE-tuxcare.1 | 4.2.20.RELEASE-tuxcare.1 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-casTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
4.2.12.RELEASE up to 4.2.12.RELEASE-tuxcare.1 | 4.2.12.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 8 CVEs |
5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1 | 5.1.5.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1 | 5.1.4.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 6 CVEs |
5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1 | 5.1.4.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 6 CVEs |
5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1 | 5.1.4.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1 | 5.1.4.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1 | 5.1.6.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-bomTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-casTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
3.2.8.RELEASE up to 3.2.8.RELEASE-tuxcare.1 | 3.2.8.RELEASE-tuxcare.1 |
org.springframework.security:spring-security-coreMaven |
5.5.0 up to 5.5.7, plus listed versions 5.5.15.5.25.5.35.5.45.5.55.5.6 |
5.5.7 |
org.springframework.security:spring-security-coreMaven |
5.6.0 up to 5.6.4, plus listed versions 5.6.15.6.25.6.3 |
5.6.4 |
org.springframework.security:spring-security-coreMaven |
before 5.4.11, plus listed versions 2.0.02.0.12.0.22.0.32.0.4 Show 45 moreShow less2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE |
5.4.11 |
org.springframework.security:spring-security-webMaven |
5.5.0 up to 5.5.7, plus listed versions 5.5.15.5.25.5.35.5.45.5.55.5.6 |
5.5.7 |
org.springframework.security:spring-security-webMaven |
5.6.0 up to 5.6.4, plus listed versions 5.6.15.6.25.6.3 |
5.6.4 |
org.springframework.security:spring-security-webMaven |
before 5.4.11, plus listed versions 3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE Show 45 moreShow less3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.1.RELEASE3.2.10.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.1.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE4.2.18.RELEASE |
5.4.11 |
jenkins-2-pluginsRed Hat:ocp_tools:4.13::el8 From an advisory covering 16 CVEs |
before 0:4.13.1684911916-1.el8 | 0:4.13.1684911916-1.el8 |
jenkinsRed Hat:ocp_tools:4.13::el8 From an advisory covering 16 CVEs |
before 0:2.387.3.1684911776-3.el8 | 0:2.387.3.1684911776-3.el8 |
org.springframework.security:spring-security-webRoot:Maven |
before 5.2.2.RELEASE-aikido.2 | 5.2.2.RELEASE-aikido.2 |
org.springframework.security:spring-security-coreRoot:Maven |
before 5.2.2.RELEASE-aikido.2 | 5.2.2.RELEASE-aikido.2 |
io.root.org.springframework.security:spring-security-webRoot:Maven |
before 5.2.2.RELEASE-root.io.2 | 5.2.2.RELEASE-root.io.2 |
io.root.org.springframework.security:spring-security-coreRoot:Maven |
before 5.2.2.RELEASE-root.io.2 | 5.2.2.RELEASE-root.io.2 |
libspring-javaUbuntu:25.10 |
All versions, plus listed versions 4.3.30-2ubuntu14.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.10 |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.04:LTS |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | DeEpinGh0st/CVE-2022-22978 | 2022-05-31 |
| PoC in GitHub | ducluongtran9121/CVE-2022-22978-PoC | 2022-06-04 |
| PoC in GitHub | aeifkz/CVE-2022-22978 | 2022-07-13 |
| PoC in GitHub | umakant76705/CVE-2022-22978 | 2023-03-01 |
| PoC in GitHub | Raghvendra1207/CVE-2022-22978 | 2023-03-16 |
| PoC in GitHub | wan9xx/CVE-2022-22978-demo | 2024-05-17 |
| PoC in GitHub | he-ewo/CVE-2022-22978 | 2025-04-06 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected, exploits, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-22978 is a critical vulnerability (CVSS 9.8) in Spring Security, published May 19, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 12.4%, the 96th percentile. Fixed in org.springframework.security:spring-security-core 5.6.4.
References
spring.io/security/cve-2022-22978
nvd.nist.gov/vuln/detail/CVE-2022-22978
tanzu.vmware.com/security/cve-2022-22978
oracle.com/security-alerts/cpujul2022.html
security.netapp.com/advisory/ntap-20220707-0003
github.com/anchore/grype/issues/2158
Show 81 moreShow less
access.redhat.com/errata/RHSA-2023:3299
bugzilla.redhat.com/show_bug.cgi?id=1856376
issues.redhat.com/browse/PITEAM-10
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3299.json
cve.org/CVERecord?id=CVE-2020-7692
blogs.apache.org/security/entry/cve-2022-42889
lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om
seclists.org/oss-sec/2022/q4/22
jenkins.io/security/advisory/2023-01-24
commons.apache.org/proper/commons-fileupload/security-reports.html
ubuntu.com/security/CVE-2022-22978
Left out here: 179 versions. The JSON record has them.