Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

Spring: actively exploited vulnerabilities

5 vulnerabilities in Spring products (Spring Cloud Config, Spring Cloud Function, Spring Cloud Gateway…) are in CISA’s catalog of exploited vulnerabilities. Last added: August 25, 2022.

Spring security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one Spring category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • Spring Cloud Config 1 vulnerability · Frameworks
  • Spring Cloud Function 1 vulnerability · Frameworks
  • Spring Cloud Gateway 1 vulnerability · Frameworks
  • Spring Data 1 vulnerability · Frameworks
  • Spring Framework 1 vulnerability · Frameworks

Names used by CISA: VMware, VMware Tanzu. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Spring list.

  1. Rank 1Spring Cloud Gateway

    CVE-2022-22947

    VMware Spring Cloud Gateway Code Injection Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    May 16, 2022
    CISA deadline
    21 days
    CVSS severity
    10.0 (critical)

  2. Rank 2Spring Cloud Function

    CVE-2022-22963

    VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Aug 25, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  3. Rank 3Spring Framework

    CVE-2022-22965

    Spring Framework JDK 9+ Remote Code Execution Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Apr 4, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  4. Rank 4Spring Data

    CVE-2018-1273

    RansomwareCVE from 2018, added in 2022

    VMware Tanzu Spring Data Commons Property Binder Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 25, 2022
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  5. Rank 5Spring Cloud Config

    CVE-2020-5410

    CVE from 2020, added in 2022

    VMware Tanzu Spring Cloud Config Directory Traversal Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Mar 25, 2022
    CISA deadline
    21 days
    CVSS severity
    7.5 (high)

Follow and verify

Get new Spring vulnerabilities: RSS feed (add it to Outlook, Teams, Slack or your feed reader).

Indicative classification, based on the vendor and product names given by CISA. How products are classified.