{"id":"CVE-2022-22978","aliases":["CLSA-2026-1773015254","CLSA-2026-1775694713","CLSA-2026-1792102802","CLSA-2026-1792502421","CLSA-2026-1792503291","CLSA-2026-1792588191","EUVD-2022-4151","GHSA-hh32-7344-cg2f","RHSA-2023:3299","ROOT-APP-MAVEN-CVE-2022-22978","UBUNTU-CVE-2022-22978"],"status":"published","title":"Authorization bypass in Spring Security","description":"In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.12351,"percentile":0.96228,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-285","CWE-863"],"published":"2022-05-19T00:00:00Z","modified":"2026-11-04T20:01:53Z","exploits":[{"source":"pocgithub","id":"DeEpinGh0st/CVE-2022-22978","title":"DeEpinGh0st/CVE-2022-22978","date":"2022-05-31","url":"https://github.com/DeEpinGh0st/CVE-2022-22978"},{"source":"pocgithub","id":"ducluongtran9121/CVE-2022-22978-PoC","title":"ducluongtran9121/CVE-2022-22978-PoC","date":"2022-06-04","url":"https://github.com/ducluongtran9121/CVE-2022-22978-PoC"},{"source":"pocgithub","id":"aeifkz/CVE-2022-22978","title":"aeifkz/CVE-2022-22978","date":"2022-07-13","url":"https://github.com/aeifkz/CVE-2022-22978"},{"source":"pocgithub","id":"umakant76705/CVE-2022-22978","title":"umakant76705/CVE-2022-22978","date":"2023-03-01","url":"https://github.com/umakant76705/CVE-2022-22978"},{"source":"pocgithub","id":"Raghvendra1207/CVE-2022-22978","title":"Raghvendra1207/CVE-2022-22978","date":"2023-03-16","url":"https://github.com/Raghvendra1207/CVE-2022-22978"},{"source":"pocgithub","id":"wan9xx/CVE-2022-22978-demo","title":"wan9xx/CVE-2022-22978-demo","date":"2024-05-17","url":"https://github.com/wan9xx/CVE-2022-22978-demo"},{"source":"pocgithub","id":"he-ewo/CVE-2022-22978","title":"he-ewo/CVE-2022-22978","date":"2025-04-06","url":"https://github.com/he-ewo/CVE-2022-22978"}],"fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-core","fixed_in":["5.6.4","5.5.7","5.4.11"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.springframework.security:spring-security-web","fixed_in":["5.5.7","5.6.4","5.4.11"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-web","fixed_in":["5.2.2.RELEASE-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-core","fixed_in":["5.2.2.RELEASE-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-web","fixed_in":["5.2.2.RELEASE-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-core","fixed_in":["5.2.2.RELEASE-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.11"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.11"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.20.RELEASE"},{"fixed":"4.2.20.RELEASE-tuxcare.1"}]}],"versions":["4.2.20.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.20.RELEASE"},{"fixed":"4.2.20.RELEASE-tuxcare.1"}]}],"versions":["4.2.20.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.20.RELEASE"},{"fixed":"4.2.20.RELEASE-tuxcare.1"}]}],"versions":["4.2.20.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.20.RELEASE"},{"fixed":"4.2.20.RELEASE-tuxcare.1"}]}],"versions":["4.2.20.RELEASE"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.RELEASE"},{"fixed":"4.2.12.RELEASE-tuxcare.1"}]}],"versions":["4.2.12.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-cas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.RELEASE"},{"fixed":"4.2.12.RELEASE-tuxcare.1"}]}],"versions":["4.2.12.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.RELEASE"},{"fixed":"4.2.12.RELEASE-tuxcare.1"}]}],"versions":["4.2.12.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.RELEASE"},{"fixed":"4.2.12.RELEASE-tuxcare.1"}]}],"versions":["4.2.12.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.12.RELEASE"},{"fixed":"4.2.12.RELEASE-tuxcare.1"}]}],"versions":["4.2.12.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8.RELEASE"},{"fixed":"3.2.8.RELEASE-tuxcare.1"}]}],"versions":["3.2.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-cas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8.RELEASE"},{"fixed":"3.2.8.RELEASE-tuxcare.1"}]}],"versions":["3.2.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8.RELEASE"},{"fixed":"3.2.8.RELEASE-tuxcare.1"}]}],"versions":["3.2.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8.RELEASE"},{"fixed":"3.2.8.RELEASE-tuxcare.1"}]}],"versions":["3.2.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.8.RELEASE"},{"fixed":"3.2.8.RELEASE-tuxcare.1"}]}],"versions":["3.2.8.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.7"}]}],"versions":["5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.4"}]}],"versions":["5.6.0","5.6.1","5.6.2","5.6.3"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.11"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5.RELEASE","2.0.6.RELEASE","2.0.7.RELEASE","2.0.8.RELEASE","3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.0.8.RELEASE","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","3.1.5.RELEASE","3.1.6.RELEASE","3.1.7.RELEASE","3.2.0.RELEASE","3.2.1.RELEASE","3.2.10.RELEASE","3.2.2.RELEASE","3.2.3.RELEASE","3.2.4.RELEASE","3.2.5.RELEASE","3.2.6.RELEASE","3.2.7.RELEASE","3.2.8.RELEASE","3.2.9.RELEASE","4.0.0.RELEASE","4.0.1.RELEASE","4.0.2.RELEASE","4.0.3.RELEASE","4.0.4.RELEASE","4.1.0.RELEASE","4.1.1.RELEASE","4.1.2.RELEASE","4.1.3.RELEASE","4.1.4.RELEASE","4.1.5.RELEASE","4.2.0.RELEASE","4.2.1.RELEASE","4.2.10.RELEASE","4.2.11.RELEASE","4.2.12.RELEASE","4.2.13.RELEASE","4.2.14.RELEASE","4.2.15.RELEASE","4.2.16.RELEASE","4.2.17.RELEASE","4.2.18.RELEASE","4.2.19.RELEASE","4.2.2.RELEASE","4.2.20.RELEASE","4.2.3.RELEASE","4.2.4.RELEASE","4.2.5.RELEASE","4.2.6.RELEASE","4.2.7.RELEASE","4.2.8.RELEASE","4.2.9.RELEASE","5.0.0.RELEASE","5.0.1.RELEASE","5.0.10.RELEASE","5.0.11.RELEASE","5.0.12.RELEASE","5.0.13.RELEASE","5.0.14.RELEASE","5.0.15.RELEASE","5.0.16.RELEASE","5.0.17.RELEASE","5.0.18.RELEASE","5.0.19.RELEASE","5.0.2.RELEASE","5.0.3.RELEASE","5.0.4.RELEASE","5.0.5.RELEASE","5.0.6.RELEASE","5.0.7.RELEASE","5.0.8.RELEASE","5.0.9.RELEASE","5.1.0.RELEASE","5.1.1.RELEASE","5.1.10.RELEASE","5.1.11.RELEASE","5.1.12.RELEASE","5.1.13.RELEASE","5.1.2.RELEASE","5.1.3.RELEASE","5.1.4.RELEASE","5.1.5.RELEASE","5.1.6.RELEASE","5.1.7.RELEASE","5.1.8.RELEASE","5.1.9.RELEASE","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.2.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE","5.3.0.RELEASE","5.3.1.RELEASE","5.3.10.RELEASE","5.3.11.RELEASE","5.3.12.RELEASE","5.3.13.RELEASE","5.3.2.RELEASE","5.3.3.RELEASE","5.3.4.RELEASE","5.3.5.RELEASE","5.3.6.RELEASE","5.3.7.RELEASE","5.3.8.RELEASE","5.3.9.RELEASE","5.4.0","5.4.1","5.4.10","5.4.2","5.4.3","5.4.4","5.4.5","5.4.6","5.4.7","5.4.8","5.4.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.5.7"}]}],"versions":["5.5.0","5.5.1","5.5.2","5.5.3","5.5.4","5.5.5","5.5.6"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.0"},{"fixed":"5.6.4"}]}],"versions":["5.6.0","5.6.1","5.6.2","5.6.3"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4.11"}]}],"versions":["3.0.0.RELEASE","3.0.1.RELEASE","3.0.2.RELEASE","3.0.3.RELEASE","3.0.4.RELEASE","3.0.5.RELEASE","3.0.6.RELEASE","3.0.7.RELEASE","3.0.8.RELEASE","3.1.0.RELEASE","3.1.1.RELEASE","3.1.2.RELEASE","3.1.3.RELEASE","3.1.4.RELEASE","3.1.5.RELEASE","3.1.6.RELEASE","3.1.7.RELEASE","3.2.0.RELEASE","3.2.1.RELEASE","3.2.10.RELEASE","3.2.2.RELEASE","3.2.3.RELEASE","3.2.4.RELEASE","3.2.5.RELEASE","3.2.6.RELEASE","3.2.7.RELEASE","3.2.8.RELEASE","3.2.9.RELEASE","4.0.0.RELEASE","4.0.1.RELEASE","4.0.2.RELEASE","4.0.3.RELEASE","4.0.4.RELEASE","4.1.0.RELEASE","4.1.1.RELEASE","4.1.2.RELEASE","4.1.3.RELEASE","4.1.4.RELEASE","4.1.5.RELEASE","4.2.0.RELEASE","4.2.1.RELEASE","4.2.10.RELEASE","4.2.11.RELEASE","4.2.12.RELEASE","4.2.13.RELEASE","4.2.14.RELEASE","4.2.15.RELEASE","4.2.16.RELEASE","4.2.17.RELEASE","4.2.18.RELEASE","4.2.19.RELEASE","4.2.2.RELEASE","4.2.20.RELEASE","4.2.3.RELEASE","4.2.4.RELEASE","4.2.5.RELEASE","4.2.6.RELEASE","4.2.7.RELEASE","4.2.8.RELEASE","4.2.9.RELEASE","5.0.0.RELEASE","5.0.1.RELEASE","5.0.10.RELEASE","5.0.11.RELEASE","5.0.12.RELEASE","5.0.13.RELEASE","5.0.14.RELEASE","5.0.15.RELEASE","5.0.16.RELEASE","5.0.17.RELEASE","5.0.18.RELEASE","5.0.19.RELEASE","5.0.2.RELEASE","5.0.3.RELEASE","5.0.4.RELEASE","5.0.5.RELEASE","5.0.6.RELEASE","5.0.7.RELEASE","5.0.8.RELEASE","5.0.9.RELEASE","5.1.0.RELEASE","5.1.1.RELEASE","5.1.10.RELEASE","5.1.11.RELEASE","5.1.12.RELEASE","5.1.13.RELEASE","5.1.2.RELEASE","5.1.3.RELEASE","5.1.4.RELEASE","5.1.5.RELEASE","5.1.6.RELEASE","5.1.7.RELEASE","5.1.8.RELEASE","5.1.9.RELEASE","5.2.0.RELEASE","5.2.1.RELEASE","5.2.10.RELEASE","5.2.11.RELEASE","5.2.12.RELEASE","5.2.13.RELEASE","5.2.14.RELEASE","5.2.15.RELEASE","5.2.2.RELEASE","5.2.3.RELEASE","5.2.4.RELEASE","5.2.5.RELEASE","5.2.6.RELEASE","5.2.7.RELEASE","5.2.8.RELEASE","5.2.9.RELEASE","5.3.0.RELEASE","5.3.1.RELEASE","5.3.10.RELEASE","5.3.11.RELEASE","5.3.12.RELEASE","5.3.13.RELEASE","5.3.2.RELEASE","5.3.3.RELEASE","5.3.4.RELEASE","5.3.5.RELEASE","5.3.6.RELEASE","5.3.7.RELEASE","5.3.8.RELEASE","5.3.9.RELEASE","5.4.0","5.4.1","5.4.10","5.4.2","5.4.3","5.4.4","5.4.5","5.4.6","5.4.7","5.4.8","5.4.9"]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1684911916-1.el8"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.387.3.1684911776-3.el8"}]}],"bundled":16},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2.RELEASE-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2.RELEASE-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2.RELEASE-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.2.RELEASE-root.io.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-2ubuntu1","4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libspring-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.30-3ubuntu1"]}],"products":[{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"oracle","product":"financial_services_crime_and_compliance_management_studio"},{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"https://spring.io/security/cve-2022-22978","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22978","tags":["advisory"]},{"url":"https://tanzu.vmware.com/security/cve-2022-22978","tags":["web","article","report"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220707-0003","tags":["web"]},{"url":"https://github.com/anchore/grype/issues/2158","tags":["web"]},{"url":"https://github.com/spring-projects/spring-security/blob/main/web/src/main/java/org/springframework/security/web/util/matcher/RegexRequestMatcher.java","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hh32-7344-cg2f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/22xxx/CVE-2022-22978.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-security","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3299","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1856376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2034388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134292","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2135435","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170039","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172298","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2177646","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2185707","tags":["report"]},{"url":"https://issues.redhat.com/browse/PITEAM-10","tags":["article"]},{"url":"https://issues.redhat.com/browse/PITEAM-9","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3299.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7692","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7692","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-4178","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4178","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4178","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-46877","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46877","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46877","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22978","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22978","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080850","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25647","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40151","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40151","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40152","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40152","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3f7h-mf4q-vrm4","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-42889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-42889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42889","tags":["advisory"]},{"url":"https://blogs.apache.org/security/entry/cve-2022-42889","tags":["article"]},{"url":"https://lists.apache.org/thread/n2bd4vdsgkqh2tm14l1wyc3jyol7s1om","tags":["article"]},{"url":"https://seclists.org/oss-sec/2022/q4/22","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24422","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24422","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24422","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-3016","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24998","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-24998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24998","tags":["advisory"]},{"url":"https://commons.apache.org/proper/commons-fileupload/security-reports.html#Fixed_in_Apache_Commons_FileUpload_1.5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25761","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25761","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3032","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25762","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25762","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-02-15/#SECURITY-3019","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27900","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27900","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-3030","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27901","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27901","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27902","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27902","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-1807","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27904","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27904","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27904","tags":["advisory"]},{"url":"https://www.jenkins.io/security/advisory/2023-03-08/#SECURITY-2120","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2022-22978","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-22978","description":"In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.","status":"published","published":"2022-05-19T00:00:00Z","modified":"2024-08-03T03:28:42.507Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:26.645563Z"}],"euvd":[{"id":"EUVD-2022-4151","description":"In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.","status":"published","published":"2022-05-19T00:00:00Z","modified":"2024-08-03T03:28:42Z","updated_at":"2026-11-03T03:25:51.741657Z"}],"ghsa":[{"id":"GHSA-hh32-7344-cg2f","title":"Authorization bypass in Spring Security","description":"In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.","status":"published","published":"2022-05-20T00:00:39Z","modified":"2024-10-04T20:22:03Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T14:38:08.742903Z"}],"nvd":[{"id":"CVE-2022-22978","description":"In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.","status":"published","published":"2022-05-19T15:15:08.057Z","modified":"2026-06-17T04:29:17.077Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:20.264424Z"}],"osv":[{"id":"GHSA-hh32-7344-cg2f","title":"Authorization bypass in Spring Security","description":"In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.","status":"published","published":"2022-05-20T00:00:39Z","modified":"2024-10-04T20:33:08.79441Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-285","CWE-863"],"updated_at":"2026-11-02T15:46:49.28217Z"},{"id":"RHSA-2023:3299","title":"Red Hat Security Advisory: jenkins and jenkins-2-plugins security update","status":"published","published":"2024-09-30T16:34:57Z","modified":"2026-10-13T10:04:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"UBUNTU-CVE-2022-22978","description":"In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.","status":"published","published":"2022-05-19T15:15:00Z","modified":"2026-11-04T20:01:53.378720107Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-06T14:22:04.552531Z"},{"id":"CLSA-2026-1773015254","title":"TuxCare security update for org.springframework.security (5 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 5 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:11Z","modified":"2026-11-02T19:45:19.521539828Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1775694713","title":"TuxCare security update for org.springframework.security (6 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 4.2.12.RELEASE-tuxcare.1.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-11-02T19:45:22.46726315Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1792102802","title":"TuxCare security update for org.springframework.security (8 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1.","status":"published","published":"2026-10-15T22:20:02Z","modified":"2026-11-02T19:46:29.511023688Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792502421","title":"TuxCare security update for org.springframework.security (6 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 5.1.4.RELEASE-tuxcare.1.","status":"published","published":"2026-10-20T13:20:21Z","modified":"2026-11-02T19:46:29.604257702Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792503291","title":"TuxCare security update for org.springframework.security (9 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.","status":"published","published":"2026-10-20T13:34:51Z","modified":"2026-11-02T19:46:29.887116039Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792588191","title":"TuxCare security update for org.springframework.security (9 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 3.2.8.RELEASE-tuxcare.1.","status":"published","published":"2026-10-21T13:09:51Z","modified":"2026-11-02T19:46:29.61327736Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CVE-2022-22978","description":"In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.","status":"published","published":"2022-05-19T00:00:00Z","modified":"2026-10-28T02:31:03.451240759Z","cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"ROOT-APP-MAVEN-CVE-2022-22978","title":"CVE-2022-22978 in org.springframework.security:spring-security-web - Patched by Root","description":"Root has patched CVE-2022-22978 in the org.springframework.security:spring-security-web package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-15T15:24:42Z","modified":"2026-10-15T16:15:05.758891542Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}