{"id":"CVE-2022-22971","title":"In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.","summary":"In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-770"],"vendor":"vmware","product":"spring_framework","affected":["spring_framework >= 5.2.0, <= 5.2.21","spring_framework >= 5.3.0, <= 5.3.19","financial_services_crime_and_compliance_management_studio = 8.0.8.2.0","financial_services_crime_and_compliance_management_studio = 8.0.8.3.0","cloud_secure_agent","oncommand_insight"],"published":"2022-05-12","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:17:16.423","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-22971","references":[{"url":"https://security.netapp.com/advisory/ntap-20220616-0003/","label":"security@vmware.com"},{"url":"https://tanzu.vmware.com/security/cve-2022-22971","label":"security@vmware.com"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"security@vmware.com"},{"url":"https://security.netapp.com/advisory/ntap-20220616-0003/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://tanzu.vmware.com/security/cve-2022-22971","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-22971.json"},{"url":"https://access.redhat.com/security/cve/CVE-2022-22971"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087274"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22971"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22971"},{"url":"https://access.redhat.com/errata/RHSA-2023:3185"},{"url":"https://access.redhat.com/errata/RHSA-2023:1661"},{"url":"https://access.redhat.com/errata/RHSA-2022:5532"}],"tags":["nvd","exploit-available","csaf","vex","red-hat","cve.org"],"epss":0.03174,"epssPercentile":0.87976,"exploits":{"github":1,"githubRepos":["https://github.com/tchize/CVE-2022-22971"],"checkedAt":"2026-10-27T16:40:24.078Z"},"exploitAvailable":true,"ingestedAt":"2026-10-08T23:16:47.343Z","patched":["amq_broker 7.10.3","amq_broker 7.11.0","fuse 7.11"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-08T21:08:37.845968Z"},"slug":"CVE-2022-22971","body":"## Overview\n\nIn spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.\n\n## Affected\n\n- `spring_framework >= 5.2.0, <= 5.2.21`\n- `spring_framework >= 5.3.0, <= 5.3.19`\n- `financial_services_crime_and_compliance_management_studio = 8.0.8.2.0`\n- `financial_services_crime_and_compliance_management_studio = 8.0.8.3.0`\n- `cloud_secure_agent`\n- `oncommand_insight`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2023:3185** · Red Hat · fixed in: AMQ Broker 7.10.3 · released 2023-05-17 · [advisory](https://access.redhat.com/errata/RHSA-2023:3185)\n- **RHSA-2023:1661** · Red Hat · fixed in: AMQ Broker 7.11.0 · released 2023-04-05 · [advisory](https://access.redhat.com/errata/RHSA-2023:1661)\n- **RHSA-2022:5532** · Red Hat · fixed in: Red Hat Fuse 7.11 · released 2022-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2022:5532)\n- **Red Hat VEX** · Moderate · affected: Red Hat Decision Manager 7, Red Hat JBoss BRMS 5, Red Hat JBoss Data Grid 7, Red Hat JBoss Data Virtualization 6, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Fuse 6, … · no fix planned: Red Hat JBoss BRMS 5, Red Hat JBoss Data Grid 7, Red Hat JBoss Data Virtualization 6, Red Hat JBoss Enterprise Application Platform 6, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-22971.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.6,"exploitation":12,"ransomware":0},"changes":[]}