# org.springframework:spring-beans (Maven) vulnerabilities 2 known vulnerabilities (1 critical), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 7.0.10 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 7.0.10 (Oct 22, 2026), the latest release - Dependents: 1,867 - Releases: 336 since 1.0 (Nov 26, 2005) - Registry: https://central.sonatype.com/artifact/org.springframework/spring-beans - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2022-22970: 1.0-m4 to 5.2.21.RELEASE (5.2.22.RELEASE is outside it); 5.3.0 to 5.3.19 (5.3.20 is outside it) - CVE-2022-22965: 1.0-m4 to 5.2.19.RELEASE (5.2.20.RELEASE is outside it); 5.3.0 to 5.3.17 (5.3.18 is outside it) ## Advisories (2) ### [CVE-2022-22970](https://cve.now/CVE-2022-22970): In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable t - Severity: Unrated - Published: May 12, 2022 - Affected: fixed in 5.2.22.RELEASE; from 5.3.0, fixed in 5.3.20. - Fixed in 5.2.22.RELEASE (released May 11, 2022, 1 day before disclosure) and 5.3.20 (released May 11, 2022, 1 day before disclosure). - The latest release, 7.0.10, is not affected. ### [CVE-2022-22965](https://cve.now/CVE-2022-22965): A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. - Severity: Critical 9.8 ยท KEV - Published: Apr 1, 2022 - Affected: fixed in 5.2.20.RELEASE; from 5.3.0, fixed in 5.3.18. - Fixed in 5.2.20.RELEASE (released Mar 31, 2022, 1 day before disclosure) and 5.3.18 (released Mar 31, 2022, 1 day before disclosure). - The latest release, 7.0.10, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.springframework:spring-beans Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.