Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework:spring-beans

2 known vulnerabilities (1 critical), with the versions each affects and the releases that fix them.

Latest release
7.0.10 (Oct 22, 2026): no advisory affects it
Newest unaffected release
7.0.10 (Oct 22, 2026), the latest release
Advisories
2 · 1 critical
Dependents
1,867
Releases
336 since 1.0 (Nov 26, 2005)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2022-22970
    Affects 1.0-m4 to 5.2.21.RELEASE (5.2.22.RELEASE is outside it); 5.3.0 to 5.3.19 (5.3.20 is outside it)
  • CVE-2022-22965
    Affects 1.0-m4 to 5.2.19.RELEASE (5.2.20.RELEASE is outside it); 5.3.0 to 5.3.17 (5.3.18 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable t

    Affected: fixed in 5.2.22.RELEASE; from 5.3.0, fixed in 5.3.20.

    Fixed in 5.2.22.RELEASE (released May 11, 2022, 1 day before disclosure) and 5.3.20 (released May 11, 2022, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.

  • CVE-2022-22965Critical 9.8 · KEV

    A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.

    Affected: fixed in 5.2.20.RELEASE; from 5.3.0, fixed in 5.3.18.

    Fixed in 5.2.20.RELEASE (released Mar 31, 2022, 1 day before disclosure) and 5.3.18 (released Mar 31, 2022, 1 day before disclosure).

    The latest release, 7.0.10, is not affected.