{"id":"CVE-2021-22060","aliases":["CLSA-2025-1762906008","CLSA-2026-1776040412","CLSA-2026-1777336766","CLSA-2026-1779151623","CLSA-2026-1791463722","CLSA-2026-1791532205","CLSA-2026-1792600686","CLSA-2026-1793884738","CLSA-2026-1794178070","DEBIAN-CVE-2021-22060","EUVD-2022-0479","GHSA-6gf2-pvqw-37ph","ROOT-APP-MAVEN-CVE-2021-22060","UBUNTU-CVE-2021-22060"],"status":"published","title":"Log entry injection in Spring Framework","description":"In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00912,"percentile":0.6046,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-01-07T22:39:55Z","modified":"2026-11-09T01:45:04Z","fixes":[{"ecosystem":"Maven","package":"org.springframework:spring-core","fixed_in":["5.3.14","5.2.19"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.springframework:spring-core","fixed_in":["5.3.14-aikido.4","5.3.14-aikido.3","5.3.14-aikido.5","5.3.14-aikido.6","5.3.14-aikido.7","5.3.14-aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-core","fixed_in":["5.3.14-root.io.4","5.3.14-root.io.3","5.3.14-root.io.5","5.3.14-root.io.6","5.3.14-root.io.7","5.3.14-root.io.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.19"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-framework-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0.RELEASE"},{"fixed":"5.2.0.RELEASE-tuxcare.1"}]}],"versions":["5.2.0.RELEASE"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.7"},{"fixed":"5.3.7-tuxcare.2"}]}],"versions":["5.3.7","5.3.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.4"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.4"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.13.RELEASE"},{"fixed":"5.2.13.RELEASE-tuxcare.4"}]}],"versions":["5.2.13.RELEASE","5.2.13.RELEASE-tuxcare.1","5.2.13.RELEASE-tuxcare.2","5.2.13.RELEASE-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.30.RELEASE"},{"fixed":"4.3.30.RELEASE-tuxcare.3"}]}],"versions":["4.3.30.RELEASE","4.3.30.RELEASE-tuxcare.1","4.3.30.RELEASE-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.30.RELEASE"},{"fixed":"4.3.30.RELEASE-tuxcare.3"}]}],"versions":["4.3.30.RELEASE","4.3.30.RELEASE-tuxcare.1","4.3.30.RELEASE-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.4"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1","4.0.0.RELEASE-tuxcare.2","4.0.0.RELEASE-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.4"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1","4.0.0.RELEASE-tuxcare.2","4.0.0.RELEASE-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.4"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1","4.0.0.RELEASE-tuxcare.2","4.0.0.RELEASE-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.4"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1","4.0.0.RELEASE-tuxcare.2","4.0.0.RELEASE-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.4"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1","4.0.0.RELEASE-tuxcare.2","4.0.0.RELEASE-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.4"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1","4.0.0.RELEASE-tuxcare.2","4.0.0.RELEASE-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.4"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1","4.0.0.RELEASE-tuxcare.2","4.0.0.RELEASE-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0.RELEASE"},{"fixed":"4.0.0.RELEASE-tuxcare.4"}]}],"versions":["4.0.0.RELEASE","4.0.0.RELEASE-tuxcare.1","4.0.0.RELEASE-tuxcare.2","4.0.0.RELEASE-tuxcare.3"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.4"}]}],"versions":["3.1.1.RELEASE","3.1.1.RELEASE-tuxcare.1","3.1.1.RELEASE-tuxcare.2","3.1.1.RELEASE-tuxcare.3"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.4"}]}],"versions":["3.1.1.RELEASE","3.1.1.RELEASE-tuxcare.1","3.1.1.RELEASE-tuxcare.2","3.1.1.RELEASE-tuxcare.3"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.4"}]}],"versions":["3.1.1.RELEASE","3.1.1.RELEASE-tuxcare.1","3.1.1.RELEASE-tuxcare.2","3.1.1.RELEASE-tuxcare.3"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.4"}]}],"versions":["3.1.1.RELEASE","3.1.1.RELEASE-tuxcare.1","3.1.1.RELEASE-tuxcare.2","3.1.1.RELEASE-tuxcare.3"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.4"}]}],"versions":["3.1.1.RELEASE","3.1.1.RELEASE-tuxcare.1","3.1.1.RELEASE-tuxcare.2","3.1.1.RELEASE-tuxcare.3"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.4"}]}],"versions":["3.1.1.RELEASE","3.1.1.RELEASE-tuxcare.1","3.1.1.RELEASE-tuxcare.2","3.1.1.RELEASE-tuxcare.3"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1.RELEASE"},{"fixed":"3.1.1.RELEASE-tuxcare.4"}]}],"versions":["3.1.1.RELEASE","3.1.1.RELEASE-tuxcare.1","3.1.1.RELEASE-tuxcare.2","3.1.1.RELEASE-tuxcare.3"],"bundled":17},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.2"}]}],"versions":["5.3.13","5.3.13-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.2"}]}],"versions":["5.3.13","5.3.13-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.2"}]}],"versions":["5.3.13","5.3.13-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.13"},{"fixed":"5.3.13-tuxcare.2"}]}],"versions":["5.3.13","5.3.13-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.5"},{"fixed":"5.3.5-tuxcare.3"}]}],"versions":["5.3.5","5.3.5-tuxcare.1","5.3.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-beans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.3"}]}],"versions":["5.3.6","5.3.6-tuxcare.1","5.3.6-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.3"}]}],"versions":["5.3.6","5.3.6-tuxcare.1","5.3.6-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.3"}]}],"versions":["5.3.6","5.3.6-tuxcare.1","5.3.6-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-expression","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.3"}]}],"versions":["5.3.6","5.3.6-tuxcare.1","5.3.6-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.3"}]}],"versions":["5.3.6","5.3.6-tuxcare.1","5.3.6-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webflux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.3"}]}],"versions":["5.3.6","5.3.6-tuxcare.1","5.3.6-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-webmvc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.3"}]}],"versions":["5.3.6","5.3.6-tuxcare.1","5.3.6-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework:spring-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.6"},{"fixed":"5.3.6-tuxcare.3"}]}],"versions":["5.3.6","5.3.6-tuxcare.1","5.3.6-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"Debian:12","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-3","4.3.30-4","4.3.30-5","4.3.30-6"]},{"source":"osv","ecosystem":"Debian:13","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3","4.3.30-4","4.3.30-5","4.3.30-6"]},{"source":"osv","ecosystem":"Debian:14","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3","4.3.30-4","4.3.30-5","4.3.30-6"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.14"}]}],"versions":["5.3.0","5.3.1","5.3.10","5.3.11","5.3.12","5.3.13","5.3.2","5.3.3","5.3.4","5.3.5","5.3.6","5.3.7","5.3.8","5.3.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.19"}]}],"versions":["5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.16.RELEASE","5.2.17.RELEASE","5.2.18.RELEASE","5.2.2.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.14-aikido.4"},{"fixed":"5.3.14-aikido.3"},{"fixed":"5.3.14-aikido.5"},{"fixed":"5.3.14-aikido.6"},{"fixed":"5.3.14-aikido.7"},{"fixed":"5.3.14-aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework:spring-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.14-root.io.4"},{"fixed":"5.3.14-root.io.3"},{"fixed":"5.3.14-root.io.5"},{"fixed":"5.3.14-root.io.6"},{"fixed":"5.3.14-root.io.7"},{"fixed":"5.3.14-root.io.8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.6.RELEASE-7","3.0.6.RELEASE-8","3.0.6.RELEASE-9","3.0.6.RELEASE-10","3.0.6.RELEASE-11","3.0.6.RELEASE-12","3.0.6.RELEASE-13","3.0.6.RELEASE-13ubuntu0.1~esm1","3.0.6.RELEASE-13ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.13-3","3.2.13-4","3.2.13-5","3.2.13-5ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.11-1","4.3.12-1","4.3.13-2","4.3.14-1","4.3.22-1~18.04","4.3.22-1~18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.22-4","4.3.22-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-1","4.3.30-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2","4.3.30-2ubuntu0.24.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2ubuntu1","4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]}],"products":[{"vendor":"oracle","product":"communications_cloud_native_core_console"},{"vendor":"oracle","product":"communications_cloud_native_core_service_communication_proxy"},{"vendor":"vmware","product":"spring framework"},{"vendor":"vmware","product":"spring_framework"}],"references":[{"url":"https://tanzu.vmware.com/security/cve-2021-22060","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22060","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6gf2-pvqw-37ph"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-22060","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22060","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22060","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-22060","description":"In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.","status":"published","published":"2022-01-07T22:39:55Z","modified":"2024-08-03T18:30:23.916Z","updated_at":"2026-11-02T14:32:58.028461Z"}],"euvd":[{"id":"EUVD-2022-0479","description":"In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.","status":"published","published":"2022-01-07T22:39:55Z","modified":"2024-08-03T18:30:23Z","updated_at":"2026-11-03T03:25:03.638882Z"}],"ghsa":[{"id":"GHSA-6gf2-pvqw-37ph","title":"Log entry injection in Spring Framework","description":"In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.","status":"published","published":"2022-01-12T23:04:06Z","modified":"2023-02-03T05:04:29Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T14:36:41.967989Z"}],"nvd":[{"id":"CVE-2021-22060","description":"In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.","status":"published","published":"2022-01-10T14:10:16.68Z","modified":"2026-06-17T03:36:37.457Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:03.418194Z"}],"osv":[{"id":"CVE-2021-22060","description":"In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.","status":"published","published":"2022-01-10T14:10:16.68Z","modified":"2026-10-24T10:30:25.514149811Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-22060","description":"In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.","status":"published","published":"2022-01-10T14:10:16.68Z","modified":"2026-10-23T18:03:24.842525981Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-6gf2-pvqw-37ph","title":"Log entry injection in Spring Framework","description":"In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.","status":"published","published":"2022-01-12T23:04:06Z","modified":"2024-12-04T05:23:15.708427Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"ROOT-APP-MAVEN-CVE-2021-22060","title":"CVE-2021-22060 in org.springframework:spring-core - Patched by Root","description":"Root has patched CVE-2021-22060 in the org.springframework:spring-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-30T10:18:50Z","modified":"2026-10-30T11:15:04.377068742Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2021-22060","description":"In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.","status":"published","published":"2022-01-10T14:10:00Z","modified":"2026-10-17T12:56:19.172385189Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"CLSA-2025-1762906008","title":"TuxCare security update for org.springframework (13 CVEs)","description":"TuxCare rebuilt 10 org.springframework packages to address 13 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-11-02T19:45:06.085973092Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1776040412","title":"TuxCare security update for org.springframework (13 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 13 CVEs. Fixed in 5.3.7-tuxcare.2.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-11-02T19:45:23.931874136Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1777336766","title":"TuxCare security update for org.springframework (4 CVEs)","description":"TuxCare rebuilt 3 org.springframework packages to address 4 CVEs. Fixed in 5.2.13.RELEASE-tuxcare.4.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-11-02T19:45:28.410408612Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1779151623","title":"TuxCare security update for org.springframework (2 CVEs)","description":"TuxCare rebuilt 2 org.springframework packages to address 2 CVEs. Fixed in 4.3.30.RELEASE-tuxcare.3.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-11-02T19:45:30.09241961Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1791463722","title":"TuxCare security update for org.springframework (20 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 20 CVEs. Fixed in 4.0.0.RELEASE-tuxcare.4.","status":"published","published":"2026-10-08T12:48:42Z","modified":"2026-11-02T19:46:26.305132574Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791532205","title":"TuxCare security update for org.springframework (17 CVEs)","description":"TuxCare rebuilt 7 org.springframework packages to address 17 CVEs. Fixed in 3.1.1.RELEASE-tuxcare.4.","status":"published","published":"2026-10-09T07:50:05Z","modified":"2026-11-02T19:46:26.862181611Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1792600686","title":"TuxCare security update for org.springframework (3 CVEs)","description":"TuxCare rebuilt 4 org.springframework packages to address 3 CVEs. Fixed in 5.3.13-tuxcare.2.","status":"published","published":"2026-10-21T16:38:05Z","modified":"2026-11-02T19:46:30.671281389Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793884738","title":"TuxCare security update for org.springframework (14 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 14 CVEs. Fixed in 5.3.5-tuxcare.3.","status":"published","published":"2026-11-05T14:18:59Z","modified":"2026-11-06T13:15:21.600459691Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1794178070","title":"TuxCare security update for org.springframework (14 CVEs)","description":"TuxCare rebuilt 8 org.springframework packages to address 14 CVEs. Fixed in 5.3.6-tuxcare.3.","status":"published","published":"2026-11-08T23:47:51Z","modified":"2026-11-09T01:45:04.248565523Z","updated_at":"2026-11-09T02:15:19.582074Z"}]}}