Log in Start free

Vulnerability · Published May 16, 2025 · Assigned by vmware

CVE-2025-22233Spring Framework DataBinder Case Sensitive Match Exception

Low 3.1

In plain English

A low-severity improper input validation in Spring Framework from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.4%top 62.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks. Affected Spring Products and Versions Spring Framework: * 6.2.0 - 6.2.6 * 6.1.0 - 6.1.19 * 6.0.0 - 6.0.27 * 5.3.0 - 5.3.42 * Older, unsupported versions are also affected Mitigation Users of affected versions should upgrade to the corresponding fixed version. Affected version(s)Fix Version Availability 6.2.x 6.2.7 OSS6.1.x 6.1.20 OSS6.0.x 6.0.28 Commercial https://enterprise.spring.io/ 5.3.x 5.3.43 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary. Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation. For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields. Credit This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libspring-javano fix listedDEBIAN-CVE-2025-22233
Debian:13libspring-javano fix listedDEBIAN-CVE-2025-22233
Debian:14libspring-javano fix listedDEBIAN-CVE-2025-22233
Mavenorg.springframework:spring-contextno fix listedGHSA-4wp7-92pw-q264
Mavenorg.springframework:spring-context6.2.7GHSA-4wp7-92pw-q264
Mavenorg.springframework:spring-context6.1.20GHSA-4wp7-92pw-q264
Mavenorg.springframework:spring-contextno fix listedGHSA-4wp7-92pw-q264
Ubuntu:25.10libspring-javano fix listedUBUNTU-CVE-2025-22233
Ubuntu:26.04:LTSlibspring-javano fix listedUBUNTU-CVE-2025-22233
Ubuntu:26.10libspring-javano fix listedUBUNTU-CVE-2025-22233

Affected products (as reported)

VendorProductVersions
Spring Spring Framework 6.2.0 – through 6.2.66.1.0 – through 6.1.196.0.0 – through 6.0.275.3.0 – through 5.3.42

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References