Spring Security Advisories

CVE-2022-22970: Spring Framework DoS via Data Binding to MultipartFile or Servlet Part

MEDIUM | MAY 11, 2022 | CVE-2022-22970


A Spring MVC or Spring WebFlux application that handles file uploads is vulnerable to DoS attack if it relies on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.

Affected Spring Products and Versions

  • Spring Framework
    • 5.3.0 to 5.3.19
    • 5.2.0 to 5.2.21
    • Older, unsupported versions are also affected


Users of affected versions should apply the following mitigation: 5.3.x users should upgrade to 5.3.20; 5.2.x users should upgrade to 5.2.22. No other steps are necessary. Releases that have fixed this issue include:

  • Spring Framework
    • 5.3.20
    • 5.2.22


This vulnerability was responsibly reported to VMware by Rob Ryan from Adobe Inc. Related variations were also reported by WeBin Lab of Dbappsecurity and by Vivek Sharm from Arcesium.


  • 2022-05-11: Initial vulnerability report published.

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Spring Runtime offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all