CVE-2024-22262
CVE-2024-22262: Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CVE-2024-22262: Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
CVE-2024-22262- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-601, CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2024-1071
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
EUVD-2024-1071- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2wrp-6fg6-hmc5
Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
GHSA-2wrp-6fg6-hmc5- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
CVE-2024-22262- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-601, CWE-918
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-22262
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
DEBIAN-CVE-2024-22262- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-2wrp-6fg6-hmc5
Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
GHSA-2wrp-6fg6-hmc5- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Show 24 moreShow less
OSVRHLW-2026-a9afa2d7b2973961
Lightwell Security Advisory: spring-web 5.3.18.rhlw-00010
Red Hat Lightwell has released org.springframework:spring-web 5.3.18.rhlw-00010 with backported fixes for CVE-2016-1000027, CVE-2024-22259, CVE-2024-22262, CVE-2024-38809, and CVE-2024-38820.
CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CVE-2024-22259: CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
CVE-2024-22262: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CVE-2024-38809: Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.
Users of affected versions should upgrade to the corresponding fixed version.
Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
CVE-2024-38820: CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception
This patched artifact is a drop-in replacement for org.springframework:spring-web 5.3.18 from Maven Central.
- Record
RHLW-2026-a9afa2d7b2973961- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-22262
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
UBUNTU-CVE-2024-22262- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2024-1727308813No score
TuxCare security update for org.springframework:spring-web (2 CVEs)
TuxCare rebuilt org.springframework:spring-web to address 2 CVEs. Fixed in 5.3.31.tuxcare.
- Record
CLSA-2024-1727308813- Updated
- 2026-11-02
OSVCLSA-2025-1756771563No score
TuxCare security update for org.springframework (16 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 16 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.1.
- Record
CLSA-2025-1756771563- Updated
- 2026-11-02
OSVCLSA-2025-1760313981No score
TuxCare security update for org.springframework (25 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 25 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313981- Updated
- 2026-11-02
OSVCLSA-2025-1760313986No score
TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313986- Updated
- 2026-11-02
OSVCLSA-2025-1762906011No score
TuxCare security update for org.springframework (12 CVEs)
TuxCare rebuilt 8 org.springframework packages to address 12 CVEs. Fixed in 5.3.30-tuxcare.1.
- Record
CLSA-2025-1762906011- Updated
- 2026-11-02
OSVCLSA-2025-1765930087No score
TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 4 CVEs. Fixed in 5.3.29-tuxcare.3.
- Record
CLSA-2025-1765930087- Updated
- 2026-11-02
OSVCLSA-2025-1766016492No score
TuxCare security update for org.springframework (11 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 11 CVEs. Fixed in 6.0.16-tuxcare.1.
- Record
CLSA-2025-1766016492- Updated
- 2026-11-02
OSVCLSA-2025-1766534902No score
TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 4 CVEs. Fixed in 5.3.27-tuxcare.2.
- Record
CLSA-2025-1766534902- Updated
- 2026-11-02
OSVCLSA-2026-1777423179No score
TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 6 CVEs. Fixed in 5.3.25-tuxcare.2.
- Record
CLSA-2026-1777423179- Updated
- 2026-11-02
OSVCLSA-2026-1777509589No score
TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 3 org.springframework packages to address 4 CVEs. Fixed in 5.3.24-tuxcare.2.
- Record
CLSA-2026-1777509589- Updated
- 2026-11-02
OSVCLSA-2026-1777855418No score
TuxCare security update for org.springframework:spring-web (2 CVEs)
TuxCare rebuilt org.springframework:spring-web to address 2 CVEs. Fixed in 4.1.7.RELEASE-tuxcare.4.
- Record
CLSA-2026-1777855418- Updated
- 2026-11-02
OSVCLSA-2026-1782781162No score
TuxCare security update for org.springframework:spring-web (1 CVE)
TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.3.7-tuxcare.3.
- Record
CLSA-2026-1782781162- Updated
- 2026-11-02
OSVCLSA-2026-1782867606No score
TuxCare security update for org.springframework (12 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 12 CVEs. Fixed in 4.1.9.RELEASE-tuxcare.1.
- Record
CLSA-2026-1782867606- Updated
- 2026-11-02
OSVCLSA-2026-1783386124No score
TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.5.
- Record
CLSA-2026-1783386124- Updated
- 2026-11-02
OSVCLSA-2026-1785030424No score
TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 14 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785030424- Updated
- 2026-11-02
OSVCLSA-2026-1785957662No score
TuxCare security update for org.springframework (7 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 7 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.7.
- Record
CLSA-2026-1785957662- Updated
- 2026-11-02
OSVCLSA-2026-1793624500No score
TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 3 CVEs. Fixed in 5.3.21-tuxcare.6.
- Record
CLSA-2026-1793624500- Updated
- 2026-11-02
OSVCLSA-2026-1793630574No score
TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 10 CVEs. Fixed in 5.3.23-tuxcare.4.
- Record
CLSA-2026-1793630574- Updated
- 2026-11-02
OSVCLSA-2026-1793897973No score
TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 5.1.8.RELEASE-tuxcare.2.
- Record
CLSA-2026-1793897973- Updated
- 2026-11-06
OSVCLSA-2026-1794485639No score
TuxCare security update for org.springframework:spring-web (1 CVE)
TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.3.20-tuxcare.5.
- Record
CLSA-2026-1794485639- Updated
- 2026-11-12
OSVCLSA-2026-1794486191No score
TuxCare security update for org.springframework:spring-web (2 CVEs)
TuxCare rebuilt org.springframework:spring-web to address 2 CVEs. Fixed in 5.2.11.RELEASE-tuxcare.5.
- Record
CLSA-2026-1794486191- Updated
- 2026-11-12
OSVNo score
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
CVE-2024-22262- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webMaven | before 5.3.34 | 5.3.34 |
org.springframework:spring-webMaven | 6.0.0 up to 6.0.19 | 6.0.19 |
org.springframework:spring-webMaven | 6.1.0 up to 6.1.6 | 6.1.6 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 2 CVEs | 5.3.31 up to 5.3.31.tuxcare | 5.3.31.tuxcare |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 16 CVEs | 4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 16 CVEs | 4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 16 CVEs | 4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 16 CVEs | 4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 16 CVEs | 4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 16 CVEs | 4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
Show 103 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-beansTuxCare:Maven From an advisory covering 25 CVEs | 4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 25 CVEs | 4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 25 CVEs | 4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 25 CVEs | 4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 25 CVEs | 4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 25 CVEs | 4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 29 CVEs | 3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 29 CVEs | 3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 29 CVEs | 3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 29 CVEs | 3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-oxmTuxCare:Maven From an advisory covering 29 CVEs | 3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 29 CVEs | 3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 29 CVEs | 3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 12 CVEs | 5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 12 CVEs | 5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 12 CVEs | 5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 12 CVEs | 5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 12 CVEs | 5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 12 CVEs | 5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 12 CVEs | 5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 12 CVEs | 5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 4 CVEs | 5.3.29 up to 5.3.29-tuxcare.3, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.2 | 5.3.29-tuxcare.3 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 4 CVEs | 5.3.29 up to 5.3.29-tuxcare.3, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.2 | 5.3.29-tuxcare.3 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 4 CVEs | 5.3.29 up to 5.3.29-tuxcare.3, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.2 | 5.3.29-tuxcare.3 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 4 CVEs | 5.3.29 up to 5.3.29-tuxcare.3, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.2 | 5.3.29-tuxcare.3 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 4 CVEs | 5.3.29 up to 5.3.29-tuxcare.3, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.2 | 5.3.29-tuxcare.3 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 11 CVEs | 6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 11 CVEs | 6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 11 CVEs | 6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 11 CVEs | 6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 11 CVEs | 6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 11 CVEs | 6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 11 CVEs | 6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 4 CVEs | 5.3.27 up to 5.3.27-tuxcare.2, plus listed versions 5.3.27.tuxcare.1 | 5.3.27-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 4 CVEs | 5.3.27 up to 5.3.27-tuxcare.2, plus listed versions 5.3.27.tuxcare.1 | 5.3.27-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 4 CVEs | 5.3.27 up to 5.3.27-tuxcare.2, plus listed versions 5.3.27.tuxcare.1 | 5.3.27-tuxcare.2 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 4 CVEs | 5.3.27 up to 5.3.27-tuxcare.2, plus listed versions 5.3.27.tuxcare.1 | 5.3.27-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 6 CVEs | 5.3.25 up to 5.3.25-tuxcare.2, plus listed versions 5.3.25-tuxcare.1 | 5.3.25-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 6 CVEs | 5.3.25 up to 5.3.25-tuxcare.2, plus listed versions 5.3.25-tuxcare.1 | 5.3.25-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 6 CVEs | 5.3.25 up to 5.3.25-tuxcare.2, plus listed versions 5.3.25-tuxcare.1 | 5.3.25-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 6 CVEs | 5.3.25 up to 5.3.25-tuxcare.2, plus listed versions 5.3.25-tuxcare.1 | 5.3.25-tuxcare.2 |
org.springframework:springTuxCare:Maven From an advisory covering 4 CVEs | 5.3.24 up to 5.3.24-tuxcare.2, plus listed versions 5.3.24-tuxcare.1 | 5.3.24-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 4 CVEs | 5.3.24 up to 5.3.24-tuxcare.2, plus listed versions 5.3.24-tuxcare.1 | 5.3.24-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 4 CVEs | 5.3.24 up to 5.3.24-tuxcare.2, plus listed versions 5.3.24-tuxcare.1 | 5.3.24-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 2 CVEs | 4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.4, plus listed versions 4.1.7.RELEASE-tuxcare.14.1.7.RELEASE-tuxcare.24.1.7.RELEASE-tuxcare.3 | 4.1.7.RELEASE-tuxcare.4 |
org.springframework:spring-webTuxCare:Maven | 5.3.7 up to 5.3.7-tuxcare.3, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.2 | 5.3.7-tuxcare.3 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 12 CVEs | 4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 12 CVEs | 4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 12 CVEs | 4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 12 CVEs | 4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 12 CVEs | 4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 12 CVEs | 4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 12 CVEs | 4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 10 CVEs | 4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.5, plus listed versions 4.2.9.RELEASE-tuxcare.14.2.9.RELEASE-tuxcare.24.2.9.RELEASE-tuxcare.34.2.9.RELEASE-tuxcare.4 | 4.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 10 CVEs | 4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.5, plus listed versions 4.2.9.RELEASE-tuxcare.14.2.9.RELEASE-tuxcare.24.2.9.RELEASE-tuxcare.34.2.9.RELEASE-tuxcare.4 | 4.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 10 CVEs | 4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.5, plus listed versions 4.2.9.RELEASE-tuxcare.14.2.9.RELEASE-tuxcare.24.2.9.RELEASE-tuxcare.34.2.9.RELEASE-tuxcare.4 | 4.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 10 CVEs | 4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.5, plus listed versions 4.2.9.RELEASE-tuxcare.14.2.9.RELEASE-tuxcare.24.2.9.RELEASE-tuxcare.34.2.9.RELEASE-tuxcare.4 | 4.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 10 CVEs | 4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.5, plus listed versions 4.2.9.RELEASE-tuxcare.14.2.9.RELEASE-tuxcare.24.2.9.RELEASE-tuxcare.34.2.9.RELEASE-tuxcare.4 | 4.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 14 CVEs | 5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 | 5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 7 CVEs | 5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 | 5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 7 CVEs | 5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 | 5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 7 CVEs | 5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 | 5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 7 CVEs | 5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 | 5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 3 CVEs | 5.3.21 up to 5.3.21-tuxcare.6, plus listed versions 5.3.21-tuxcare.15.3.21-tuxcare.25.3.21-tuxcare.35.3.21-tuxcare.45.3.21-tuxcare.5 | 5.3.21-tuxcare.6 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 3 CVEs | 5.3.21 up to 5.3.21-tuxcare.6, plus listed versions 5.3.21-tuxcare.15.3.21-tuxcare.25.3.21-tuxcare.35.3.21-tuxcare.45.3.21-tuxcare.5 | 5.3.21-tuxcare.6 |
org.springframework:springTuxCare:Maven From an advisory covering 10 CVEs | 5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 | 5.3.23-tuxcare.4 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 10 CVEs | 5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 | 5.3.23-tuxcare.4 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 10 CVEs | 5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 | 5.3.23-tuxcare.4 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 10 CVEs | 5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 | 5.3.23-tuxcare.4 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 10 CVEs | 5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 | 5.3.23-tuxcare.4 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 10 CVEs | 5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 | 5.3.23-tuxcare.4 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 10 CVEs | 5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 | 5.3.23-tuxcare.4 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 10 CVEs | 5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 | 5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 10 CVEs | 5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 | 5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 10 CVEs | 5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 | 5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 10 CVEs | 5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 | 5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 10 CVEs | 5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 | 5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven | 5.3.20 up to 5.3.20-tuxcare.5, plus listed versions 5.3.20-tuxcare.15.3.20-tuxcare.25.3.20-tuxcare.35.3.20-tuxcare.4 | 5.3.20-tuxcare.5 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 2 CVEs | 5.2.11.RELEASE up to 5.2.11.RELEASE-tuxcare.5, plus listed versions 5.2.11.RELEASE-tuxcare.15.2.11.RELEASE-tuxcare.25.2.11.RELEASE-tuxcare.35.2.11.RELEASE-tuxcare.4 | 5.2.11.RELEASE-tuxcare.5 |
libspring-javaDebian:12 | All versions, plus listed versions 4.3.30-24.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1 | None known |
libspring-javaDebian:13 | All versions, plus listed versions 4.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1 | None known |
libspring-javaDebian:14 | All versions, plus listed versions 4.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1 | None known |
org.springframework:spring-webMaven | before 5.3.34, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE | 5.3.34 |
org.springframework:spring-webMaven | 6.0.0 up to 6.0.19, plus listed versions 6.0.16.0.106.0.116.0.126.0.13 Show 13 moreShow less6.0.146.0.156.0.166.0.176.0.186.0.26.0.36.0.46.0.56.0.66.0.76.0.86.0.9 | 6.0.19 |
org.springframework:spring-webMaven | 6.1.0 up to 6.1.6, plus listed versions 6.1.16.1.26.1.36.1.46.1.5 | 6.1.6 |
org.springframework:spring-webRed Hat Lightwell:Maven From an advisory covering 5 CVEs | before 5.3.18.rhlw-00010, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE | 5.3.18.rhlw-00010 |
libspring-javaUbuntu:Pro:14.04:LTS | All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2 | None known |
libspring-javaUbuntu:Pro:16.04:LTS | All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1 | None known |
libspring-javaUbuntu:Pro:18.04:LTS | All versions, plus listed versions 4.3.11-14.3.12-14.3.13-24.3.14-14.3.22-1~18.044.3.22-1~18.04.1~esm1 | None known |
libspring-javaUbuntu:Pro:20.04:LTS | All versions, plus listed versions 4.3.22-44.3.22-4ubuntu0.1~esm1 | None known |
libspring-javaUbuntu:Pro:22.04:LTS | All versions, plus listed versions 4.3.30-14.3.30-1ubuntu0.1~esm1 | None known |
libspring-javaUbuntu:Pro:24.04:LTS | All versions, plus listed versions 4.3.30-24.3.30-2ubuntu0.24.04.1~esm1 | None known |
libspring-javaUbuntu:25.10 | All versions, plus listed versions 4.3.30-2ubuntu14.3.30-3ubuntu1 | None known |
libspring-javaUbuntu:26.10 | All versions, plus listed versions 4.3.30-3ubuntu1 | None known |
libspring-javaUbuntu:26.04:LTS | All versions, plus listed versions 4.3.30-3ubuntu1 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Performant-Labs/CVE-2024-22262 | 2024-11-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, aliases | ||
| affected, aliases | OSV | |
| affected | ||
| affected, facts | OSV | |
| affected | OSV | |
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-22262 is a high vulnerability (CVSS 8.1) in Spring Framework, published April 16, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in org.springframework:spring-web 5.3.34.
References
spring.io/security/cve-2024-22262
security.netapp.com/advisory/ntap-20240524-0003
nvd.nist.gov/vuln/detail/CVE-2024-22262
github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java
security-tracker.debian.org/tracker/CVE-2024-22262
Show 18 moreShow less
ubuntu.com/security/CVE-2024-22262
cve.org/CVERecord?id=CVE-2024-22262
Left out here: 373 versions. The JSON record has them.