Spring Security Advisories

CVE-2022-22963: Remote code execution in Spring Cloud Function by malicious Spring Expression

CRITICAL | MARCH 29, 2022 | CVE-2022-22963


In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Affected Spring Products and Versions

  • Spring Cloud Function
    • 3.1.6
    • 3.2.2
    • Older, unsupported versions are also affected


Users of affected versions should upgrade to 3.1.7, 3.2.3. No other steps are necessary. Releases that have fixed this issue include:

  • Spring Cloud Function
    • 3.1.7
    • 3.2.3


This vulnerability was initially discovered and responsibly reported by m09u3r.


  • 2022-03-29: Initial vulnerability report published.
  • 2022-03-31: Updates to description, severity and references.

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all