---
id: CVE-2022-22971
title: >-
  In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported
  versions, application with a STOMP over WebSocket endpoint is vulnerable to a
  denial of service attack by an authenticated user.
summary: >-
  In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported
  versions, application with a STOMP over WebSocket endpoint is vulnerable to a
  denial of service attack by an authenticated user.
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: vmware
product: spring_framework
affected:
  - 'spring_framework >= 5.2.0, <= 5.2.21'
  - 'spring_framework >= 5.3.0, <= 5.3.19'
  - financial_services_crime_and_compliance_management_studio = 8.0.8.2.0
  - financial_services_crime_and_compliance_management_studio = 8.0.8.3.0
  - cloud_secure_agent
  - oncommand_insight
published: '2022-05-12'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T22:17:16.423'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-22971'
references:
  - url: 'https://security.netapp.com/advisory/ntap-20220616-0003/'
    label: security@vmware.com
  - url: 'https://tanzu.vmware.com/security/cve-2022-22971'
    label: security@vmware.com
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: security@vmware.com
  - url: 'https://security.netapp.com/advisory/ntap-20220616-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://tanzu.vmware.com/security/cve-2022-22971'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://www.oracle.com/security-alerts/cpujul2022.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-22971.json
  - url: 'https://access.redhat.com/security/cve/CVE-2022-22971'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2087274'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2022-22971'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-22971'
  - url: 'https://access.redhat.com/errata/RHSA-2023:3185'
  - url: 'https://access.redhat.com/errata/RHSA-2023:1661'
  - url: 'https://access.redhat.com/errata/RHSA-2022:5532'
tags:
  - nvd
  - exploit-available
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.03174
epssPercentile: 0.87976
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/tchize/CVE-2022-22971'
  checkedAt: '2026-10-27T16:40:24.078Z'
exploitAvailable: true
ingestedAt: '2026-10-08T23:16:47.343Z'
patched:
  - amq_broker 7.10.3
  - amq_broker 7.11.0
  - fuse 7.11
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-08T21:08:37.845968Z'
---

## Overview

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

## Affected

- `spring_framework >= 5.2.0, <= 5.2.21`
- `spring_framework >= 5.3.0, <= 5.3.19`
- `financial_services_crime_and_compliance_management_studio = 8.0.8.2.0`
- `financial_services_crime_and_compliance_management_studio = 8.0.8.3.0`
- `cloud_secure_agent`
- `oncommand_insight`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2023:3185** · Red Hat · fixed in: AMQ Broker 7.10.3 · released 2023-05-17 · [advisory](https://access.redhat.com/errata/RHSA-2023:3185)
- **RHSA-2023:1661** · Red Hat · fixed in: AMQ Broker 7.11.0 · released 2023-04-05 · [advisory](https://access.redhat.com/errata/RHSA-2023:1661)
- **RHSA-2022:5532** · Red Hat · fixed in: Red Hat Fuse 7.11 · released 2022-07-07 · [advisory](https://access.redhat.com/errata/RHSA-2022:5532)
- **Red Hat VEX** · Moderate · affected: Red Hat Decision Manager 7, Red Hat JBoss BRMS 5, Red Hat JBoss Data Grid 7, Red Hat JBoss Data Virtualization 6, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Fuse 6, … · no fix planned: Red Hat JBoss BRMS 5, Red Hat JBoss Data Grid 7, Red Hat JBoss Data Virtualization 6, Red Hat JBoss Enterprise Application Platform 6, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-22971.json)