CVE-2024-22262
CVE-2024-22262: Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CVE-2024-22262: Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
CVE-2024-22262- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-601, CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2024-1071
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
EUVD-2024-1071- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2wrp-6fg6-hmc5
Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
GHSA-2wrp-6fg6-hmc5- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
CVE-2024-22262- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-601, CWE-918
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-22262
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
DEBIAN-CVE-2024-22262- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-2wrp-6fg6-hmc5
Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
GHSA-2wrp-6fg6-hmc5- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Show 23 moreShow less
OSVRHLW-2026-a9afa2d7b2973961
Lightwell Security Advisory: spring-web 5.3.18.rhlw-00010
Red Hat Lightwell has released org.springframework:spring-web 5.3.18.rhlw-00010 with backported fixes for CVE-2016-1000027, CVE-2024-22259, CVE-2024-22262, CVE-2024-38809, and CVE-2024-38820.
CVE-2016-1000027: Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.
CVE-2024-22259: CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
CVE-2024-22262: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
CVE-2024-38809: Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack.
Users of affected versions should upgrade to the corresponding fixed version.
Users of older, unsupported versions could enforce a size limit on "If-Match" and "If-None-Match" headers, e.g. through a Filter.
CVE-2024-38820: CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception
This patched artifact is a drop-in replacement for org.springframework:spring-web 5.3.18 from Maven Central.
- Record
RHLW-2026-a9afa2d7b2973961- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2024-22262
CVE-2024-22262 in org.springframework:spring-web - Patched by Root
Root has patched CVE-2024-22262 in the org.springframework:spring-web package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2024-22262- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-04
OSVUBUNTU-CVE-2024-22262
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
UBUNTU-CVE-2024-22262- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2024-1727308813 No score
TuxCare security update for org.springframework:spring-web (2 CVEs)
TuxCare rebuilt org.springframework:spring-web to address 2 CVEs. Fixed in 5.3.31.tuxcare.
- Record
CLSA-2024-1727308813- Updated
- 2026-11-02
OSVCLSA-2025-1756771563 No score
TuxCare security update for org.springframework (16 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 16 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.1.
- Record
CLSA-2025-1756771563- Updated
- 2026-11-02
OSVCLSA-2025-1760313981 No score
TuxCare security update for org.springframework (25 CVEs)
TuxCare rebuilt 6 org.springframework packages to address 25 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313981- Updated
- 2026-11-02
OSVCLSA-2025-1760313986 No score
TuxCare security update for org.springframework (29 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 29 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.1.
- Record
CLSA-2025-1760313986- Updated
- 2026-11-02
OSVCLSA-2025-1762906011 No score
TuxCare security update for org.springframework (12 CVEs)
TuxCare rebuilt 8 org.springframework packages to address 12 CVEs. Fixed in 5.3.30-tuxcare.1.
- Record
CLSA-2025-1762906011- Updated
- 2026-11-02
OSVCLSA-2025-1765930087 No score
TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 4 CVEs. Fixed in 5.3.29-tuxcare.3.
- Record
CLSA-2025-1765930087- Updated
- 2026-11-02
OSVCLSA-2025-1766016492 No score
TuxCare security update for org.springframework (11 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 11 CVEs. Fixed in 6.0.16-tuxcare.1.
- Record
CLSA-2025-1766016492- Updated
- 2026-11-02
OSVCLSA-2025-1766534902 No score
TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 4 CVEs. Fixed in 5.3.27-tuxcare.2.
- Record
CLSA-2025-1766534902- Updated
- 2026-11-02
OSVCLSA-2026-1777423179 No score
TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 6 CVEs. Fixed in 5.3.25-tuxcare.2.
- Record
CLSA-2026-1777423179- Updated
- 2026-11-02
OSVCLSA-2026-1777509589 No score
TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 3 org.springframework packages to address 4 CVEs. Fixed in 5.3.24-tuxcare.2.
- Record
CLSA-2026-1777509589- Updated
- 2026-11-02
OSVCLSA-2026-1777855418 No score
TuxCare security update for org.springframework:spring-web (2 CVEs)
TuxCare rebuilt org.springframework:spring-web to address 2 CVEs. Fixed in 4.1.7.RELEASE-tuxcare.4.
- Record
CLSA-2026-1777855418- Updated
- 2026-11-02
OSVCLSA-2026-1782781162 No score
TuxCare security update for org.springframework:spring-web (1 CVE)
TuxCare rebuilt org.springframework:spring-web to address 1 CVE. Fixed in 5.3.7-tuxcare.3.
- Record
CLSA-2026-1782781162- Updated
- 2026-11-02
OSVCLSA-2026-1782867606 No score
TuxCare security update for org.springframework (12 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 12 CVEs. Fixed in 4.1.9.RELEASE-tuxcare.1.
- Record
CLSA-2026-1782867606- Updated
- 2026-11-02
OSVCLSA-2026-1783386124 No score
TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 4.2.9.RELEASE-tuxcare.5.
- Record
CLSA-2026-1783386124- Updated
- 2026-11-02
OSVCLSA-2026-1785030424 No score
TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 9 org.springframework packages to address 14 CVEs. Fixed in 5.1.9.RELEASE-tuxcare.2.
- Record
CLSA-2026-1785030424- Updated
- 2026-11-02
OSVCLSA-2026-1785957662 No score
TuxCare security update for org.springframework (7 CVEs)
TuxCare rebuilt 4 org.springframework packages to address 7 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.7.
- Record
CLSA-2026-1785957662- Updated
- 2026-11-02
OSVCLSA-2026-1793624500 No score
TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 2 org.springframework packages to address 3 CVEs. Fixed in 5.3.21-tuxcare.6.
- Record
CLSA-2026-1793624500- Updated
- 2026-11-02
OSVCLSA-2026-1793630574 No score
TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 7 org.springframework packages to address 10 CVEs. Fixed in 5.3.23-tuxcare.4.
- Record
CLSA-2026-1793630574- Updated
- 2026-11-02
OSVCLSA-2026-1793897973 No score
TuxCare security update for org.springframework (10 CVEs)
TuxCare rebuilt 5 org.springframework packages to address 10 CVEs. Fixed in 5.1.8.RELEASE-tuxcare.2.
- Record
CLSA-2026-1793897973- Updated
- 2026-11-06
OSV No score
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks.
This is the same as CVE-2024-22259 https://spring.io/security/cve-2024-22259 and CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input.
- Record
CVE-2024-22262- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-webMaven |
before 5.3.34 | 5.3.34 |
org.springframework:spring-webMaven |
6.0.0 up to 6.0.19 | 6.0.19 |
org.springframework:spring-webMaven |
6.1.0 up to 6.1.6 | 6.1.6 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 2 CVEs |
5.3.31 up to 5.3.31.tuxcare | 5.3.31.tuxcare |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 16 CVEs |
4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 16 CVEs |
4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 16 CVEs |
4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 16 CVEs |
4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 16 CVEs |
4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 16 CVEs |
4.3.30.RELEASE up to 4.3.30.RELEASE-tuxcare.1 | 4.3.30.RELEASE-tuxcare.1 |
Show 103 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework:spring-beansTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 25 CVEs |
4.0.0.RELEASE up to 4.0.0.RELEASE-tuxcare.1 | 4.0.0.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-oxmTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 29 CVEs |
3.1.1.RELEASE up to 3.1.1.RELEASE-tuxcare.1 | 3.1.1.RELEASE-tuxcare.1 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 12 CVEs |
5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 12 CVEs |
5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 12 CVEs |
5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 12 CVEs |
5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 12 CVEs |
5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 12 CVEs |
5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 12 CVEs |
5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 12 CVEs |
5.3.30 up to 5.3.30-tuxcare.1 | 5.3.30-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 4 CVEs |
5.3.29 up to 5.3.29-tuxcare.3, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.2 |
5.3.29-tuxcare.3 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 4 CVEs |
5.3.29 up to 5.3.29-tuxcare.3, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.2 |
5.3.29-tuxcare.3 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 4 CVEs |
5.3.29 up to 5.3.29-tuxcare.3, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.2 |
5.3.29-tuxcare.3 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 4 CVEs |
5.3.29 up to 5.3.29-tuxcare.3, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.2 |
5.3.29-tuxcare.3 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 4 CVEs |
5.3.29 up to 5.3.29-tuxcare.3, plus listed versions 5.3.29-tuxcare.15.3.29-tuxcare.2 |
5.3.29-tuxcare.3 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 11 CVEs |
6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 11 CVEs |
6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 11 CVEs |
6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 11 CVEs |
6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 11 CVEs |
6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 11 CVEs |
6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 11 CVEs |
6.0.16 up to 6.0.16-tuxcare.1 | 6.0.16-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 4 CVEs |
5.3.27 up to 5.3.27-tuxcare.2, plus listed versions 5.3.27.tuxcare.1 |
5.3.27-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 4 CVEs |
5.3.27 up to 5.3.27-tuxcare.2, plus listed versions 5.3.27.tuxcare.1 |
5.3.27-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 4 CVEs |
5.3.27 up to 5.3.27-tuxcare.2, plus listed versions 5.3.27.tuxcare.1 |
5.3.27-tuxcare.2 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 4 CVEs |
5.3.27 up to 5.3.27-tuxcare.2, plus listed versions 5.3.27.tuxcare.1 |
5.3.27-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 6 CVEs |
5.3.25 up to 5.3.25-tuxcare.2, plus listed versions 5.3.25-tuxcare.1 |
5.3.25-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 6 CVEs |
5.3.25 up to 5.3.25-tuxcare.2, plus listed versions 5.3.25-tuxcare.1 |
5.3.25-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 6 CVEs |
5.3.25 up to 5.3.25-tuxcare.2, plus listed versions 5.3.25-tuxcare.1 |
5.3.25-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 6 CVEs |
5.3.25 up to 5.3.25-tuxcare.2, plus listed versions 5.3.25-tuxcare.1 |
5.3.25-tuxcare.2 |
org.springframework:springTuxCare:Maven From an advisory covering 4 CVEs |
5.3.24 up to 5.3.24-tuxcare.2, plus listed versions 5.3.24-tuxcare.1 |
5.3.24-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 4 CVEs |
5.3.24 up to 5.3.24-tuxcare.2, plus listed versions 5.3.24-tuxcare.1 |
5.3.24-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 4 CVEs |
5.3.24 up to 5.3.24-tuxcare.2, plus listed versions 5.3.24-tuxcare.1 |
5.3.24-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 2 CVEs |
4.1.7.RELEASE up to 4.1.7.RELEASE-tuxcare.4, plus listed versions 4.1.7.RELEASE-tuxcare.14.1.7.RELEASE-tuxcare.24.1.7.RELEASE-tuxcare.3 |
4.1.7.RELEASE-tuxcare.4 |
org.springframework:spring-webTuxCare:Maven |
5.3.7 up to 5.3.7-tuxcare.3, plus listed versions 5.3.7-tuxcare.15.3.7-tuxcare.2 |
5.3.7-tuxcare.3 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-messagingTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 12 CVEs |
4.1.9.RELEASE up to 4.1.9.RELEASE-tuxcare.1 | 4.1.9.RELEASE-tuxcare.1 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 10 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.5, plus listed versions 4.2.9.RELEASE-tuxcare.14.2.9.RELEASE-tuxcare.24.2.9.RELEASE-tuxcare.34.2.9.RELEASE-tuxcare.4 |
4.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 10 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.5, plus listed versions 4.2.9.RELEASE-tuxcare.14.2.9.RELEASE-tuxcare.24.2.9.RELEASE-tuxcare.34.2.9.RELEASE-tuxcare.4 |
4.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-jmsTuxCare:Maven From an advisory covering 10 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.5, plus listed versions 4.2.9.RELEASE-tuxcare.14.2.9.RELEASE-tuxcare.24.2.9.RELEASE-tuxcare.34.2.9.RELEASE-tuxcare.4 |
4.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 10 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.5, plus listed versions 4.2.9.RELEASE-tuxcare.14.2.9.RELEASE-tuxcare.24.2.9.RELEASE-tuxcare.34.2.9.RELEASE-tuxcare.4 |
4.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 10 CVEs |
4.2.9.RELEASE up to 4.2.9.RELEASE-tuxcare.5, plus listed versions 4.2.9.RELEASE-tuxcare.14.2.9.RELEASE-tuxcare.24.2.9.RELEASE-tuxcare.34.2.9.RELEASE-tuxcare.4 |
4.2.9.RELEASE-tuxcare.5 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-contextTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-framework-bomTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-websocketTuxCare:Maven From an advisory covering 14 CVEs |
5.1.9.RELEASE up to 5.1.9.RELEASE-tuxcare.2, plus listed versions 5.1.9.RELEASE-tuxcare.1 |
5.1.9.RELEASE-tuxcare.2 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 7 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 |
5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 7 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 |
5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 7 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 |
5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 7 CVEs |
5.2.13.RELEASE up to 5.2.13.RELEASE-tuxcare.7, plus listed versions 5.2.13.RELEASE-tuxcare.15.2.13.RELEASE-tuxcare.25.2.13.RELEASE-tuxcare.35.2.13.RELEASE-tuxcare.45.2.13.RELEASE-tuxcare.55.2.13.RELEASE-tuxcare.6 |
5.2.13.RELEASE-tuxcare.7 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 3 CVEs |
5.3.21 up to 5.3.21-tuxcare.6, plus listed versions 5.3.21-tuxcare.15.3.21-tuxcare.25.3.21-tuxcare.35.3.21-tuxcare.45.3.21-tuxcare.5 |
5.3.21-tuxcare.6 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 3 CVEs |
5.3.21 up to 5.3.21-tuxcare.6, plus listed versions 5.3.21-tuxcare.15.3.21-tuxcare.25.3.21-tuxcare.35.3.21-tuxcare.45.3.21-tuxcare.5 |
5.3.21-tuxcare.6 |
org.springframework:springTuxCare:Maven From an advisory covering 10 CVEs |
5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 |
5.3.23-tuxcare.4 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 10 CVEs |
5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 |
5.3.23-tuxcare.4 |
org.springframework:spring-coreTuxCare:Maven From an advisory covering 10 CVEs |
5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 |
5.3.23-tuxcare.4 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 10 CVEs |
5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 |
5.3.23-tuxcare.4 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 10 CVEs |
5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 |
5.3.23-tuxcare.4 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 10 CVEs |
5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 |
5.3.23-tuxcare.4 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 10 CVEs |
5.3.23 up to 5.3.23-tuxcare.4, plus listed versions 5.3.23-tuxcare.15.3.23-tuxcare.25.3.23-tuxcare.3 |
5.3.23-tuxcare.4 |
org.springframework:spring-beansTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-expressionTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webfluxTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
org.springframework:spring-webmvcTuxCare:Maven From an advisory covering 10 CVEs |
5.1.8.RELEASE up to 5.1.8.RELEASE-tuxcare.2, plus listed versions 5.1.8.RELEASE-tuxcare.1 |
5.1.8.RELEASE-tuxcare.2 |
libspring-javaDebian:12 |
All versions, plus listed versions 4.3.30-24.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1 |
None known |
libspring-javaDebian:13 |
All versions, plus listed versions 4.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1 |
None known |
libspring-javaDebian:14 |
All versions, plus listed versions 4.3.30-34.3.30-44.3.30-54.3.30-65.1.20-1 |
None known |
org.springframework:spring-webMaven |
before 5.3.34, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE |
5.3.34 |
org.springframework:spring-webMaven |
6.0.0 up to 6.0.19, plus listed versions 6.0.16.0.106.0.116.0.126.0.13 Show 13 moreShow less6.0.146.0.156.0.166.0.176.0.186.0.26.0.36.0.46.0.56.0.66.0.76.0.86.0.9 |
6.0.19 |
org.springframework:spring-webMaven |
6.1.0 up to 6.1.6, plus listed versions 6.1.16.1.26.1.36.1.46.1.5 |
6.1.6 |
org.springframework:spring-webRed Hat Lightwell:Maven From an advisory covering 5 CVEs |
before 5.3.18.rhlw-00010, plus listed versions 1.01.0-rc11.0.11.11.1-rc1 Show 45 moreShow less1.1-rc21.1.11.1.21.1.31.1.41.1.51.21.2-rc11.2-rc21.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.2.92.02.0-m12.0-m22.0-m32.0-m42.0-m52.0-rc12.0-rc22.0.12.0.22.0.32.0.42.0.52.0.62.0.72.0.82.52.5.12.5.22.5.32.5.42.5.52.5.62.5.6.SEC012.5.6.SEC022.5.6.SEC033.0.0.RELEASE |
5.3.18.rhlw-00010 |
org.springframework:spring-webRoot:Maven |
before 5.3.31-aikido.4 | 5.3.31-aikido.45.3.27-aikido.25.3.20-aikido.35.3.23-aikido.35.3.18-aikido.46.1.1-aikido.35.3.20-aikido.45.3.23-aikido.45.3.27-aikido.16.0.11-aikido.75.3.23-aikido.55.3.20-aikido.55.3.23-aikido.66.1.1-aikido.46.1.1-aikido.55.3.31-aikido.56.1.1-aikido.65.3.20-aikido.65.3.14-aikido.54.0.3.RELEASE-aikido.14.0.3.RELEASE-aikido.25.3.14-aikido.64.0.3.RELEASE-aikido.34.0.3.RELEASE-aikido.45.3.31-aikido.65.3.20-aikido.75.3.14-aikido.74.0.3.RELEASE-aikido.54.0.3.RELEASE-aikido.65.3.20-aikido.85.3.14-aikido.84.0.3.RELEASE-aikido.74.0.3.RELEASE-aikido.8 |
io.root.org.springframework:spring-webRoot:Maven |
before 6.0.11-root.io.3 | 6.0.11-root.io.35.3.18-root.io.26.0.11-root.io.46.0.11-root.io.65.3.18-root.io.36.1.1-root.io.15.3.31-root.io.45.3.20-root.io.15.3.23-root.io.15.3.27-root.io.25.3.20-root.io.26.1.1-root.io.25.3.23-root.io.25.3.20-root.io.35.3.23-root.io.35.3.18-root.io.46.1.1-root.io.35.3.20-root.io.45.3.23-root.io.45.3.27-root.io.16.0.11-root.io.75.3.23-root.io.55.3.20-root.io.55.3.23-root.io.66.1.1-root.io.46.1.1-root.io.55.3.31-root.io.56.1.1-root.io.65.3.20-root.io.65.3.14-root.io.54.0.3.RELEASE-root.io.14.0.3.RELEASE-root.io.25.3.14-root.io.64.0.3.RELEASE-root.io.34.0.3.RELEASE-root.io.45.3.31-root.io.65.3.20-root.io.75.3.14-root.io.74.0.3.RELEASE-root.io.54.0.3.RELEASE-root.io.65.3.20-root.io.85.3.14-root.io.84.0.3.RELEASE-root.io.74.0.3.RELEASE-root.io.8 |
libspring-javaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.0.6.RELEASE-73.0.6.RELEASE-83.0.6.RELEASE-93.0.6.RELEASE-103.0.6.RELEASE-11 Show 4 moreShow less3.0.6.RELEASE-123.0.6.RELEASE-133.0.6.RELEASE-13ubuntu0.1~esm13.0.6.RELEASE-13ubuntu0.1~esm2 |
None known |
libspring-javaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.2.13-33.2.13-43.2.13-53.2.13-5ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.3.11-14.3.12-14.3.13-24.3.14-14.3.22-1~18.044.3.22-1~18.04.1~esm1 |
None known |
libspring-javaUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 4.3.22-44.3.22-4ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 4.3.30-14.3.30-1ubuntu0.1~esm1 |
None known |
libspring-javaUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 4.3.30-24.3.30-2ubuntu0.24.04.1~esm1 |
None known |
libspring-javaUbuntu:25.10 |
All versions, plus listed versions 4.3.30-2ubuntu14.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.10 |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
libspring-javaUbuntu:26.04:LTS |
All versions, plus listed versions 4.3.30-3ubuntu1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Performant-Labs/CVE-2024-22262 | 2024-11-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| affected, facts | OSV | |
| affected | OSV | |
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-22262 is a high vulnerability (CVSS 8.1) in Spring Framework, published April 16, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in org.springframework:spring-web 5.3.34.
References
spring.io/security/cve-2024-22262
security.netapp.com/advisory/ntap-20240524-0003
nvd.nist.gov/vuln/detail/CVE-2024-22262
github.com/spring-projects/spring-framework/blob/main/spring-web/src/main/java/org/springframework/web/util/UriComponentsBuilder.java
security-tracker.debian.org/tracker/CVE-2024-22262
Show 18 moreShow less
ubuntu.com/security/CVE-2024-22262
cve.org/CVERecord?id=CVE-2024-22262
Left out here: 373 versions. The JSON record has them.