# CVE-2022-22965: Spring Framework JDK 9+ Remote Code Execution Vulnerability

- Exploited (CISA KEV): yes, added 2022-04-04
- Published: 2022-04-01
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 99.6% (100th percentile)
- CWE: CWE-94

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | Rule published | — | — |
| Google Cloud | Before feed history | — | — |
| Fastly | Before feed history | — | — |
| F5 | Before feed history | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | Before feed history | — | — |

### Microsoft Azure

- undated · listed · rule 99001015
  > Rule 99001015: MS-ThreatIntel-WebShells · Attempted Spring Framework unsafe class object exploitation CVE-2022-22965 · Enable rule to prevent against SpringShell vulnerability
  Source: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs
- undated · listed · rule 99001015
  > Rule 99001015: MS-ThreatIntel-CVEs · Attempted Spring Framework unsafe class object exploitation CVE-2022-22965 · Keep the rule enabled to prevent against SpringShell vulnerability
  Source: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules
- undated · listed · rule 800112
  > Rule 800112: Critical - 5 · PL2 · Attempted Spring Framework unsafe class object exploitation - CVE-2022-22965
  Source: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: blocked (2 of 2 requests blocked), template CVE-2022-22965, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (2 of 2 requests blocked), template CVE-2022-22965, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2022-22965 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2022-22965