CVE-2021-22119
HighAdvisory
Published 2 Jul 2021In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.060
- 93rd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 25
- of 17,781 indexed, latest versions
- Container images
- 39
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Resource Exhaustion in Spring Security
Carried by container images the latest versions of 25 of 17,781 indexed charts deploy, on 39 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| spring-security-coremaven | 5.2.1-plain, 5.2.1.RELEASE, 5.2.2.RELEASE, 5.2.4.RELEASE+6 more | 5.2.11, 5.3.10, 5.4.7, 5.5.1 | 39 |
| spring-security-oauth2-clientmaven | 5.2.2.RELEASE, 5.3.4.RELEASE, 5.4.5, 5.5.0 | 5.2.11, 5.3.10, 5.4.7, 5.5.1 | 7 |
- OSV records
- GHSA-w9jg-gvgr-354m
Charts affected
25 by stars
Container images carrying it
39 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| apache/ | 0bd3b25c4be4 | spring-security-core | 5.2.11 | 3 |
| geoservercloud/ | 99540eef78ad | spring-security-core | 5.3.10 | 2 |
| geoservercloud/ | 5c254c53a357 | spring-security-core | 5.3.10 | 2 |
| geoservercloud/ | c687b1cbc891 | spring-security-core | 5.3.10 | 2 |
| geoservercloud/ | 5288f320cf36 | spring-security-core | 5.3.10 | 2 |
| geoservercloud/ | a30a60ac6cd0 | spring-security-core | 5.3.10 | 2 |
| airsonicadvanced/ | f7cbafac2806 | spring-security-core | 5.5.1 | 1 |
| andrianrf/ | 46abe878d9d8 | spring-security-core | 5.3.10 | 1 |
| andrianrf/ | ba560086ce15 | spring-security-core | 5.3.10 | 1 |
| apache/ | 090b7f87ec7f | spring-security-core | 5.5.1 | 1 |
| apache/ | 974efa2f21da | spring-security-core | 5.2.11 | 1 |
| atlassian/ | 37bc46cbec1a | spring-security-core | 5.2.11 | 1 |
| atlassian/ | 64a75aa4ec4e | spring-security-core | 5.4.7 | 1 |
| binhex/ | fb8952921ab6 | spring-security-core | 5.3.10 | 1 |
| elastictranscoder/ | 963ab3858c6b | spring-security-core spring-security-oauth2-client | 5.5.1 5.5.1 | 1 |
| elastictranscoder/ | 26208b8c2359 | spring-security-core spring-security-oauth2-client | 5.5.1 5.5.1 | 1 |
| elastictranscoder/ | 5b75d19e2733 | spring-security-core spring-security-oauth2-client | 5.5.1 5.5.1 | 1 |
| fimperato/ | 604012b77841 | spring-security-core | 5.4.7 | 1 |
| geonetwork/ | 20c9bb761f67 | spring-security-core | 5.3.10 | 1 |
| geoservercloud/ | 5dc0c93a1710 | spring-security-core | 5.3.10 | 1 |
| geoservercloud/ | 47ae1bdb4bcc | spring-security-core | 5.3.10 | 1 |
| geoservercloud/ | 28c3e5a8c5a3 | spring-security-core | 5.3.10 | 1 |
| geoservercloud/ | 8c70ee06d5ab | spring-security-core | 5.3.10 | 1 |
| geoservercloud/ | 42775ba6a4da | spring-security-core | 5.3.10 | 1 |
| gotson/ | 9b15ea6bfc30 | spring-security-core | 5.5.1 | 1 |
| krontechnology/ | 7feef7d2ab42 | spring-security-core | 5.4.7 | 1 |
| lavandadelpatio/ | 94e225a5a6f8 | spring-security-core spring-security-oauth2-client | 5.3.10 5.3.10 | 1 |
| lavandadelpatio/ | 92de3c3426d2 | spring-security-core spring-security-oauth2-client | 5.3.10 5.3.10 | 1 |
| lavandadelpatio/ | 71f2ccec8c0d | spring-security-core spring-security-oauth2-client | 5.4.7 5.4.7 | 1 |
| platform9community/ | 40a4970de568 | spring-security-core | 5.3.10 | 1 |
| platform9community/ | 2089811e5cc6 | spring-security-core | 5.3.10 | 1 |
| platform9community/ | d1165c94dfb3 | spring-security-core | 5.3.10 | 1 |
| platform9community/ | 8d11b50368c6 | spring-security-core | 5.3.10 | 1 |
| reportportal/ | 9df41f8fb320 | spring-security-core | 5.2.11 | 1 |
| reportportal/ | 9e73114dbd15 | spring-security-core spring-security-oauth2-client | 5.2.11 5.2.11 | 1 |
| svtechnmaa/ | 6e368ace0977 | spring-security-core | 5.2.11 | 1 |
| gcr.io/ | 0ee5f968d2ab | spring-security-core | 5.2.11 | 1 |
| ghcr.io/ | ef3670f7e0a8 | spring-security-core | 5.3.10 | 1 |
| ghcr.io/ | baa4fa9549dc | spring-security-core | 5.2.11 | 1 |