Skip to content
Exploit Radar Choose my productsProducts My radar

Products › Brands

Brand

Spring: actively exploited vulnerabilities

5 vulnerabilities in Spring products (Spring Cloud Config, Spring Cloud Function, Spring Cloud Gateway…) are in CISA’s catalog of exploited vulnerabilities. Last added: August 25, 2022.

Spring security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one Spring category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

Follow a single Spring product (Spring Cloud Config, Spring Cloud Function…) rather than the whole brand.

  • Spring Cloud Config1 vulnerability, Frameworks
  • Spring Cloud Function1 vulnerability, Frameworks
  • Spring Cloud Gateway1 vulnerability, Frameworks
  • Spring Data1 vulnerability, Frameworks
  • Spring Framework1 vulnerability, Frameworks

Names used by CISA: VMware, VMware Tanzu. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Spring list.

  1. Rank 1

    Spring Cloud GatewayCVE-2022-22947

    VMware Spring Cloud Gateway Code Injection Vulnerability

    CVSS severity 10.0critical

    Added May 16, 2022

  2. Rank 2

    Spring Cloud FunctionCVE-2022-22963

    VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

    CVSS severity 9.8critical

    Added Aug 25, 2022

  3. Rank 3

    Spring FrameworkCVE-2022-22965

    Spring Framework JDK 9+ Remote Code Execution Vulnerability

    CVSS severity 9.8critical

    Added Apr 4, 2022

  4. Rank 4

    Spring DataCVE-2018-1273

    VMware Tanzu Spring Data Commons Property Binder Vulnerability

    RansomwareCVE from 2018, added in 2022

    CVSS severity 9.8critical

    Added Mar 25, 2022

  5. Rank 5

    Spring Cloud ConfigCVE-2020-5410

    VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability

    CVE from 2020, added in 2022

    CVSS severity 7.5high

    Added Mar 25, 2022

Follow and verify

Get new Spring vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.