{"id":"CVE-2022-22963","aliases":["CLSA-2026-1794229858","EUVD-2022-1654","GHSA-6v73-fgf6-w5j7","RHSA-2022:1291"],"status":"published","title":"Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression","description":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.99938,"percentile":0.99971,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-917","CWE-94"],"published":"2022-04-01T00:00:00Z","modified":"2026-11-09T19:15:05Z","kev":{"date_added":"2022-08-25","due_date":"2022-09-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-08-25"},{"source":"kev","since":"2022-08-25"}],"exploits":[{"source":"pocgithub","id":"hktalent/spring-spel-0day-poc","title":"hktalent/spring-spel-0day-poc","date":"2022-03-26","url":"https://github.com/hktalent/spring-spel-0day-poc"},{"source":"metasploit","id":"exploit/multi/http/spring_cloud_function_spel_injection","title":"Spring Cloud Function SpEL Injection","type":"exploit","platform":"Linux,Unix","date":"2022-03-29","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/spring_cloud_function_spel_injection"},{"source":"pocgithub","id":"Kirill89/CVE-2022-22963-PoC","title":"Kirill89/CVE-2022-22963-PoC","date":"2022-03-30","url":"https://github.com/Kirill89/CVE-2022-22963-PoC"},{"source":"pocgithub","id":"RanDengShiFu/CVE-2022-22963","title":"RanDengShiFu/CVE-2022-22963","date":"2022-03-30","url":"https://github.com/RanDengShiFu/CVE-2022-22963"},{"source":"pocgithub","id":"darryk10/CVE-2022-22963","title":"darryk10/CVE-2022-22963","date":"2022-03-30","url":"https://github.com/darryk10/CVE-2022-22963"},{"source":"pocgithub","id":"dinosn/CVE-2022-22963","title":"dinosn/CVE-2022-22963","date":"2022-03-30","url":"https://github.com/dinosn/CVE-2022-22963"},{"source":"pocgithub","id":"stevemats/Spring0DayCoreExploit","title":"stevemats/Spring0DayCoreExploit","date":"2022-03-30","url":"https://github.com/stevemats/Spring0DayCoreExploit"},{"source":"pocgithub","id":"kh4sh3i/Spring-CVE","title":"kh4sh3i/Spring-CVE","date":"2022-03-31","url":"https://github.com/kh4sh3i/Spring-CVE"},{"source":"pocgithub","id":"me2nuk/CVE-2022-22963","title":"me2nuk/CVE-2022-22963","date":"2022-03-31","url":"https://github.com/me2nuk/CVE-2022-22963"},{"source":"pocgithub","id":"puckiestyle/CVE-2022-22963","title":"puckiestyle/CVE-2022-22963","date":"2022-03-31","url":"https://github.com/puckiestyle/CVE-2022-22963"},{"source":"pocgithub","id":"AayushmanThapaMagar/CVE-2022-22963","title":"AayushmanThapaMagar/CVE-2022-22963","date":"2022-04-01","url":"https://github.com/AayushmanThapaMagar/CVE-2022-22963"},{"source":"pocgithub","id":"twseptian/cve-2022-22963","title":"twseptian/cve-2022-22963","date":"2022-04-03","url":"https://github.com/twseptian/cve-2022-22963"},{"source":"pocgithub","id":"SealPaPaPa/SpringCloudFunction-Research","title":"SealPaPaPa/SpringCloudFunction-Research","date":"2022-04-05","url":"https://github.com/SealPaPaPa/SpringCloudFunction-Research"},{"source":"pocgithub","id":"G01d3nW01f/CVE-2022-22963","title":"G01d3nW01f/CVE-2022-22963","date":"2022-04-11","url":"https://github.com/G01d3nW01f/CVE-2022-22963"},{"source":"pocgithub","id":"k3rwin/spring-cloud-function-rce","title":"k3rwin/spring-cloud-function-rce","date":"2022-04-14","url":"https://github.com/k3rwin/spring-cloud-function-rce"},{"source":"pocgithub","id":"iliass-dahman/CVE-2022-22963-POC","title":"iliass-dahman/CVE-2022-22963-POC","date":"2023-01-15","url":"https://github.com/iliass-dahman/CVE-2022-22963-POC"},{"source":"pocgithub","id":"charis3306/CVE-2022-22963","title":"charis3306/CVE-2022-22963","date":"2023-03-07","url":"https://github.com/charis3306/CVE-2022-22963"},{"source":"pocgithub","id":"lemmyz4n3771/CVE-2022-22963-PoC","title":"lemmyz4n3771/CVE-2022-22963-PoC","date":"2023-03-13","url":"https://github.com/lemmyz4n3771/CVE-2022-22963-PoC"},{"source":"pocgithub","id":"J0ey17/CVE-2022-22963_Reverse-Shell-Exploit","title":"J0ey17/CVE-2022-22963_Reverse-Shell-Exploit","date":"2023-03-18","url":"https://github.com/J0ey17/CVE-2022-22963_Reverse-Shell-Exploit"},{"source":"pocgithub","id":"Mustafa1986/CVE-2022-22963","title":"Mustafa1986/CVE-2022-22963","date":"2023-03-21","url":"https://github.com/Mustafa1986/CVE-2022-22963"},{"source":"pocgithub","id":"SourM1lk/CVE-2022-22963-Exploit","title":"SourM1lk/CVE-2022-22963-Exploit","date":"2023-04-10","url":"https://github.com/SourM1lk/CVE-2022-22963-Exploit"},{"source":"pocgithub","id":"randallbanner/Spring-Cloud-Function-Vulnerability-CVE-2022-22963-RCE","title":"randallbanner/Spring-Cloud-Function-Vulnerability-CVE-2022-22963-RCE","date":"2023-04-17","url":"https://github.com/randallbanner/Spring-Cloud-Function-Vulnerability-CVE-2022-22963-RCE"},{"source":"pocgithub","id":"gunzf0x/CVE-2022-22963","title":"gunzf0x/CVE-2022-22963","date":"2023-05-03","url":"https://github.com/gunzf0x/CVE-2022-22963"},{"source":"pocgithub","id":"nikn0laty/RCE-in-Spring-Cloud-CVE-2022-22963","title":"nikn0laty/RCE-in-Spring-Cloud-CVE-2022-22963","date":"2023-05-25","url":"https://github.com/nikn0laty/RCE-in-Spring-Cloud-CVE-2022-22963"},{"source":"exploitdb","id":"EDB-51577","title":"Spring Cloud 3.2.2 - Remote Command Execution (RCE)","type":"webapps","platform":"java","date":"2023-07-11","url":"https://www.exploit-db.com/exploits/51577"},{"source":"pocgithub","id":"BearClaw96/CVE-2022-22963-Poc-Bearcules","title":"BearClaw96/CVE-2022-22963-Poc-Bearcules","date":"2023-10-28","url":"https://github.com/BearClaw96/CVE-2022-22963-Poc-Bearcules"},{"source":"pocgithub","id":"xmqaq/CVE-2022-22963","title":"xmqaq/CVE-2022-22963","date":"2023-12-28","url":"https://github.com/xmqaq/CVE-2022-22963"},{"source":"nuclei","id":"CVE-2022-22963","title":"Spring Cloud - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-22963.yaml"}],"exploits_more":5,"fixes":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","fixed_in":["3.2.3","3.1.7"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","fixed_in":["0:1.0.1-2.el8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9.RELEASE"},{"fixed":"3.0.9.RELEASE-tuxcare.1"}]}],"versions":["3.0.9.RELEASE"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.cloud:spring-cloud-function-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9.RELEASE"},{"fixed":"3.0.9.RELEASE-tuxcare.1"}]}],"versions":["3.0.9.RELEASE"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.cloud:spring-cloud-function-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9.RELEASE"},{"fixed":"3.0.9.RELEASE-tuxcare.1"}]}],"versions":["3.0.9.RELEASE"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.3"}]}],"versions":["3.2.0","3.2.1","3.2.2"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.7"}]}],"versions":["1.0.0.RELEASE","1.0.1.RELEASE","1.0.2.RELEASE","2.0.0.RELEASE","2.0.1.RELEASE","2.0.2.RELEASE","2.1.0.RELEASE","2.1.1.RELEASE","3.0.0.RELEASE","3.0.1.RELEASE","3.0.10.RELEASE","3.0.11.RELEASE","3.0.12.RELEASE","3.0.13.RELEASE","3.0.14.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.0.8.RELEASE","3.0.9.RELEASE","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6"]},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.el8"}]}]}],"products":[{"vendor":"oracle","product":"banking_branch"},{"vendor":"oracle","product":"banking_cash_management"},{"vendor":"oracle","product":"banking_corporate_lending_process_management"},{"vendor":"oracle","product":"banking_credit_facilities_process_management"},{"vendor":"oracle","product":"banking_electronic_data_exchange_for_corporates"},{"vendor":"oracle","product":"banking_liquidity_management"},{"vendor":"oracle","product":"banking_origination"},{"vendor":"oracle","product":"banking_supply_chain_finance"},{"vendor":"oracle","product":"banking_trade_finance_process_management"},{"vendor":"oracle","product":"banking_virtual_account_management"},{"vendor":"oracle","product":"communications_cloud_native_core_automated_test_suite"},{"vendor":"oracle","product":"communications_cloud_native_core_console"},{"vendor":"oracle","product":"communications_cloud_native_core_network_exposure_function"},{"vendor":"oracle","product":"communications_cloud_native_core_network_function_cloud_native_environment"},{"vendor":"oracle","product":"communications_cloud_native_core_network_repository_function"},{"vendor":"oracle","product":"communications_cloud_native_core_network_slice_selection_function"},{"vendor":"oracle","product":"communications_cloud_native_core_policy"},{"vendor":"oracle","product":"communications_cloud_native_core_security_edge_protection_proxy"},{"vendor":"oracle","product":"communications_cloud_native_core_unified_data_repository"},{"vendor":"oracle","product":"communications_communications_policy_management"},{"vendor":"oracle","product":"financial_services_analytical_applications_infrastructure"},{"vendor":"oracle","product":"financial_services_behavior_detection_platform"},{"vendor":"oracle","product":"financial_services_enterprise_case_management"},{"vendor":"oracle","product":"mysql_enterprise_monitor"},{"vendor":"oracle","product":"product_lifecycle_analytics"},{"vendor":"oracle","product":"retail_xstore_point_of_service"},{"vendor":"oracle","product":"sd-wan_edge"},{"vendor":"vmware","product":"spring_cloud_function"},{"vendor":"vmware tanzu","product":"spring cloud"}],"references":[{"url":"https://tanzu.vmware.com/security/cve-2022-22963","tags":["x_transferred","Vendor Advisory","web","article"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-java-spring-scf-rce-DQrHhJxH","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0005","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"http://packetstormsecurity.com/files/173430/Spring-Cloud-3.2.2-Remote-Command-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-22963","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22963","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6v73-fgf6-w5j7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22963.json","tags":["advisory"]},{"url":"https://github.com/spring-cloud/spring-cloud-function","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2022:1291","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/security/vulnerabilities/RHSB-2022-003","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070668","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1291.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22963","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22963","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2022-22963","description":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","status":"published","published":"2022-04-01T00:00:00Z","modified":"2025-10-21T23:15:42.941Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:26.293612Z"}],"euvd":[{"id":"EUVD-2022-1654","description":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","status":"published","published":"2022-04-01T00:00:00Z","modified":"2025-10-21T23:15:42Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-08-25","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-6v73-fgf6-w5j7","title":"Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression","description":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","status":"published","published":"2022-04-03T00:00:59Z","modified":"2025-10-22T19:18:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-94","CWE-917"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2022-22963","title":"VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability","description":"When using routing functionality in VMware Tanzu's Spring Cloud Function, it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","cwes":["CWE-94"],"kev":{"date_added":"2022-08-25","due_date":"2022-09-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-22963","description":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","status":"published","published":"2022-04-01T23:15:13.663Z","modified":"2026-06-17T04:29:15.34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94","CWE-917"],"updated_at":"2026-11-02T14:07:14.706146Z"}],"osv":[{"id":"CVE-2022-22963","description":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","status":"published","published":"2022-04-01T00:00:00Z","modified":"2026-10-28T02:31:14.081016114Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"GHSA-6v73-fgf6-w5j7","title":"Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression","description":"In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.","status":"published","published":"2022-04-03T00:00:59Z","modified":"2025-10-22T19:37:35.793185Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-917","CWE-94"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"RHSA-2022:1291","title":"Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.21.1","status":"published","published":"2024-09-16T07:46:00Z","modified":"2026-03-18T11:31:43.831708Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"CLSA-2026-1794229858","title":"TuxCare security update for org.springframework.cloud (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.cloud packages to address 3 CVEs. Fixed in 3.0.9.RELEASE-tuxcare.1.","status":"published","published":"2026-11-09T14:10:59Z","modified":"2026-11-09T19:15:05.8379088Z","updated_at":"2026-11-09T19:38:09.278998Z"}]}}