Spring Framework remote code execution
Framework binding is a convenience layer that turns external names into internal object changes. This disclosure is useful because it shows why a safe review needs to map the binder, the object graph, and the hosting configuration as one system. A version…
- Original severity
- critical; CVSS 9.8 source-reported; not rescored by vulns.co
- Public source
- github advisory
- Program / vendor
- VMware / Spring
- Product / surface
- Spring Framework data binding
- Weakness
- Improper neutralization of special elements in data binding · CWE-74, CWE-94
- Affected boundary
- request-binding to server behavior boundary
- Disclosure date
- 2022-03-31
- Public status checked
- 2026-09-10
- Public attribution
- rotilho, cdupuis, and briandealwis (credits listed by the source)
What the evidence established
The advisory identifies a data-binding path where specially formed request properties could alter server-side behavior in affected deployments.
Why the impact was credible
The source rates the issue Critical with CVSS 9.8, making version and deployment-condition review essential.
Durable engineering lesson
Framework binding is a convenience layer that turns external names into internal object changes. This disclosure is useful because it shows why a safe review needs to map the binder, the object graph, and the hosting configuration as one system. A version check is necessary, but a good remediation check also confirms that the risky binding conditions cannot reappear through configuration drift.
Control pattern
Upgrade to a fixed framework release and verify binding restrictions, runtime configuration, and exposed application paths together.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.