[GHSA-36p3-wjmg-h94x] Remote Code Execution in Spring Framework - #9585

Updates

• Affected products
• CVSS v3

Comments
CVE-2022-22965 is a bug in Spring's bean data binding, and the entire upstream fix is one file in one module: commit 002546b3 changes only spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java, which compiles into spring-beans.jar and nothing else. The other four listed coordinates ship none of it — spring-webmvc-5.2.19.RELEASE.jar and spring-webflux-5.2.19.RELEASE.jar contain only org/springframework/web/** with zero entries under org/springframework/beans/, and the two Boot starters contain no classes at all. The harm is a false negative on the remediation advice: the advisory tells a spring-webmvc user the issue is "fixed": "5.2.20.RELEASE", but that jar is not meaningfully different from 5.2.19.RELEASE for this CVE — Spring version-bumps every module in lockstep. Anyone who upgrades only the coordinate the advisory named, while an older spring-beans stays resolved through a dependency-management pin or a transitive path, reads as remediated and is still exploitable. Removing the four coordinates costs no detection coverage, because each declares org.springframework:spring-beans as a non-optional compile-scope dependency (verified in the published POMs for 4.3.30.RELEASE, 5.2.19.RELEASE and 5.3.17) — every affected project still gets flagged, now against the artifact that actually has to change.