StackRadar

CVE-2022-22965

CriticalKEV

Advisory

Published 31 Mar 2022In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.996
100th percentile
CISA KEV
Listed
since 4 Apr 2022
Charts affected
208
of 17,781 indexed, latest versions
Container images
156
deployed by those charts
Fix available
5 of 5
affected packages

Remote Code Execution in Spring Framework

Carried by container images the latest versions of 208 of 17,781 indexed charts deploy, on 156 images.

Affected packageAffected versionsFixed inImages
spring-beansmaven2.5.6.SEC03, 3.0.7, 3.0.7.RELEASE, 3.2.18.RELEASE+50 more5.2.20.RELEASE, 5.3.18156
spring-webmvcmaven2.5.6.SEC03, 3.2.18.RELEASE, 4.3.1.RELEASE, 4.3.2.RELEASE+41 more5.2.20.RELEASE, 5.3.18106
spring-boot-starter-webmaven1.4.0.RELEASE, 1.5.2.RELEASE, 1.5.3.RELEASE, 1.5.4.RELEASE+28 more2.5.12, 2.6.668
spring-webfluxmaven5.2.2.RELEASE, 5.2.7.RELEASE, 5.2.8.RELEASE, 5.3.1+5 more5.2.20.RELEASE, 5.3.1836
spring-boot-starter-webfluxmaven2.2.2.RELEASE, 2.3.1.RELEASE, 2.3.2.RELEASE, 2.3.3.RELEASE+2 more2.5.12, 2.6.69
OSV records
GHSA-36p3-wjmg-h94x

Charts affected

208 by stars
ChartLatestAffected imagesRadar Score
pagesvictor-pages1.0.01 of 3See more

pages victor-pages 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-22965.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-beans@5.2.7.RELEASE
spring-boot-starter-web@2.3.1.RELEASE
spring-webmvc@5.2.7.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE

Open the chart page →

20,190
kube-monitoring-telegram-botviento-repository1.0.01 of 1See more

kube-monitoring-telegram-bot viento-repository 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-22965.

Container imageDigestPackageFixed in
vientoprojects/kubernetes-monitoring-telegram-bot:latesteb2a71531741
spring-beans@5.3.9
spring-webmvc@5.3.9
5.3.18
5.3.18

Open the chart page →

7,885
pageswalter1.0.01 of 3See more

pages walter 1.0.0

1 of the 3 container images this version deploys carry CVE-2022-22965.

Container imageDigestPackageFixed in
dellcloud/pages:monitor6ba7b22caacd
spring-beans@5.2.7.RELEASE
spring-boot-starter-web@2.3.1.RELEASE
spring-webmvc@5.2.7.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE

Open the chart page →

20,190
webapp-db-javawebapp-db-java-repo0.1.01 of 2See more

webapp-db-java webapp-db-java-repo 0.1.0

1 of the 2 container images this version deploys carry CVE-2022-22965.

Container imageDigestPackageFixed in
arturisimo/webapp-db-java:v2c95524e90b57
spring-beans@5.3.15
spring-webmvc@5.3.15
5.3.18
5.3.18

Open the chart page →

2,566
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2022-22965.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
spring-beans@5.3.15
spring-webflux@5.3.15
5.3.18
5.3.18

Open the chart page →

14,364
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2022-22965.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
spring-beans@5.3.15
spring-webflux@5.3.15
5.3.18
5.3.18

Open the chart page →

28,605
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2022-22965.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch:1.13.32acfa1dcc5f8
spring-beans@5.2.5.RELEASE
5.2.20.RELEASE

Open the chart page →

5,806
is-pattern-1wso2is-pattern15.11.01 of 2See more

is-pattern-1 wso2is-pattern1 5.11.0

1 of the 2 container images this version deploys carry CVE-2022-22965.

Container imageDigestPackageFixed in
massimolauri/wso2is:5.11.0-centose08abf0ce767
spring-beans@5.1.2.RELEASE
5.2.20.RELEASE

Open the chart page →

6,213

Container images carrying it

156 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
dellcloud/pages:monitor6ba7b22caacd
spring-beans@5.2.7.RELEASE
spring-boot-starter-web@2.3.1.RELEASE
spring-webmvc@5.2.7.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
79
mastercloudapps/planner:v1.2340a950b311b2
spring-beans@5.3.13
5.3.18
4
oscarsotosanchez/toposervice:v1.0d4d020e9f272
spring-beans@5.3.1
spring-boot-starter-webflux@2.4.0
spring-webflux@5.3.1
5.3.18
2.5.12
5.3.18
4
apache/shenyu-admin:2.4.2e8b7c4ddd069
spring-beans@5.2.2.RELEASE
spring-boot-starter-web@2.2.2.RELEASE
spring-webmvc@5.2.2.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
3
apache/shenyu-bootstrap:2.4.20bd3b25c4be4
spring-beans@5.2.2.RELEASE
spring-boot-starter-webflux@2.2.2.RELEASE
spring-webflux@5.2.2.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
3
codeurjc/planner:v1.0800cf520c245
spring-beans@5.3.13
5.3.18
3
pavanelthepu/todo-api:1.0.2f47658e3b24c
spring-beans@5.3.8
spring-webmvc@5.3.8
5.3.18
5.3.18
3
amazon/opendistro-for-elasticsearch:1.13.32acfa1dcc5f8
spring-beans@5.2.5.RELEASE
5.2.20.RELEASE
2
apachepulsar/pulsar-manager:v0.1.0b341ef76a852
spring-beans@5.0.6.RELEASE
spring-boot-starter-web@2.0.2.RELEASE
spring-webmvc@5.0.6.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
2
geoservercloud/geoserver-cloud-gateway:1.0-RC3756559ee788a
spring-beans@5.2.8.RELEASE
spring-boot-starter-webflux@2.3.3.RELEASE
spring-webflux@5.2.8.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
2
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
spring-beans@5.2.8.RELEASE
spring-boot-starter-web@2.3.3.RELEASE
spring-webflux@5.2.8.RELEASE
spring-webmvc@5.2.8.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
5.2.20.RELEASE
2
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
spring-beans@5.2.8.RELEASE
spring-boot-starter-web@2.3.3.RELEASE
spring-webflux@5.2.8.RELEASE
spring-webmvc@5.2.8.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
5.2.20.RELEASE
2
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
spring-beans@5.2.8.RELEASE
spring-boot-starter-web@2.3.3.RELEASE
spring-webflux@5.2.8.RELEASE
spring-webmvc@5.2.8.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
5.2.20.RELEASE
2
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
spring-beans@5.2.8.RELEASE
spring-boot-starter-web@2.3.3.RELEASE
spring-webflux@5.2.8.RELEASE
spring-webmvc@5.2.8.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
5.2.20.RELEASE
2
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
spring-beans@5.2.8.RELEASE
spring-boot-starter-web@2.3.3.RELEASE
spring-webflux@5.2.8.RELEASE
spring-webmvc@5.2.8.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
5.2.20.RELEASE
2
hookiesolutions/webhookie:latest0629694246ba
spring-beans@5.3.15
spring-webflux@5.3.15
5.3.18
5.3.18
2
mbentley/omada-controller:4.3f4e682274bed
spring-beans@5.1.6.RELEASE
spring-webmvc@5.1.6.RELEASE
5.2.20.RELEASE
5.2.20.RELEASE
2
nacos/nacos-server:v2.1.0dcf04549c6d7
spring-beans@5.1.18.RELEASE
spring-boot-starter-web@2.1.17.RELEASE
spring-webmvc@5.1.18.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
2
opensearchproject/opensearch:1.1.0967d7f57f72f
spring-beans@5.2.5.RELEASE
5.2.20.RELEASE
2
scorpiobroker/scorpio:RegistrySubscriptionManager_2.1.001e11d800459
spring-beans@5.3.13
spring-webflux@5.3.13
spring-webmvc@5.3.13
5.3.18
5.3.18
5.3.18
2
scorpiobroker/scorpio:eureka-server_2.1.03f05a113a4be
spring-beans@5.3.13
spring-webflux@5.3.13
spring-webmvc@5.3.13
5.3.18
5.3.18
5.3.18
2
scorpiobroker/scorpio:AtContextServer_2.1.05073ceef2fa0
spring-beans@5.3.13
spring-webflux@5.3.13
spring-webmvc@5.3.13
5.3.18
5.3.18
5.3.18
2
scorpiobroker/scorpio:gateway_2.1.062dae3dd0eeb
spring-beans@5.3.13
spring-webflux@5.3.13
spring-webmvc@5.3.13
5.3.18
5.3.18
5.3.18
2
scorpiobroker/scorpio:RegistryManager_2.1.0a2cfcf0947fd
spring-beans@5.3.13
spring-webflux@5.3.13
spring-webmvc@5.3.13
5.3.18
5.3.18
5.3.18
2
scorpiobroker/scorpio:QueryManager_2.1.0b742a53b2803
spring-beans@5.3.13
spring-webflux@5.3.13
spring-webmvc@5.3.13
5.3.18
5.3.18
5.3.18
2
scorpiobroker/scorpio:HistoryManager_2.1.0b7fe27a06ff5
spring-beans@5.3.13
spring-webflux@5.3.13
spring-webmvc@5.3.13
5.3.18
5.3.18
5.3.18
2
scorpiobroker/scorpio:config-server_1.1.0c46c1517e523
spring-beans@5.1.10.RELEASE
spring-boot-starter-web@2.1.9.RELEASE
spring-webmvc@5.1.10.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
2
scorpiobroker/scorpio:SubscriptionManager_2.1.0e08036670d66
spring-beans@5.3.13
spring-webflux@5.3.13
spring-webmvc@5.3.13
5.3.18
5.3.18
5.3.18
2
scorpiobroker/scorpio:EntityManager_2.1.0f02e8a429a08
spring-beans@5.3.13
spring-webflux@5.3.13
spring-webmvc@5.3.13
5.3.18
5.3.18
5.3.18
2
adagber/planner:v1.0e5c1ed097752
spring-beans@5.3.13
5.3.18
1
airsonicadvanced/airsonic-advanced:latestf7cbafac2806
spring-beans@5.3.8
spring-boot-starter-web@2.5.1
spring-webmvc@5.3.8
5.3.18
2.5.12
5.3.18
1
amartinm82/planner:v2.01184353ff57b
spring-beans@5.3.1
5.3.18
1
andrianrf/bpjstk-service:latest46abe878d9d8
spring-beans@5.2.9.RELEASE
spring-boot-starter-web@2.3.4.RELEASE
spring-webmvc@5.2.9.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
1
andrianrf/bpjstk-simulator:latestb63fdb51d39d
spring-beans@5.2.9.RELEASE
spring-boot-starter-web@2.3.4.RELEASE
spring-webmvc@5.2.9.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
1
andrianrf/iso-client:latestba560086ce15
spring-beans@5.2.9.RELEASE
spring-boot-starter-web@2.3.4.RELEASE
spring-webmvc@5.2.9.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
1
andrianrf/iso-server:latest7da47f525c7d
spring-beans@5.2.7.RELEASE
spring-boot-starter-web@2.3.1.RELEASE
spring-webmvc@5.2.7.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
1
apacheignite/ignite:2.7.0d7deab68b8fa
spring-beans@4.3.18.RELEASE
5.2.20.RELEASE
1
apache/iotdb:0.11.28647309f95d1
spring-beans@4.3.18.RELEASE
spring-boot-starter-web@1.5.15.RELEASE
spring-webmvc@4.3.18.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
1
apache/nifi-registry:1.14.0090b7f87ec7f
spring-beans@5.3.5
spring-boot-starter-web@2.5.1
spring-webmvc@5.3.8
5.3.18
2.5.12
5.3.18
1
apache/nifi-registry:0.8.0974efa2f21da
spring-beans@5.2.5.RELEASE
spring-boot-starter-web@2.2.6.RELEASE
spring-webmvc@5.2.5.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
1
apacherocketmq/rocketmq-dashboard:1.0.024799aff6cf8
spring-beans@5.2.1.RELEASE
spring-boot-starter-web@2.2.2.RELEASE
spring-webmvc@5.2.2.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
1
apache/skywalking-ui:8.1.067d50e4deff4
spring-beans@4.3.15.RELEASE
spring-boot-starter-web@1.5.11.RELEASE
spring-webmvc@4.3.15.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
1
apache/skywalking-ui:8.9.180530f0308a5
spring-beans@5.3.7
spring-webflux@5.3.7
5.3.18
5.3.18
1
arturisimo/planner:v1.0fff9de644941
spring-beans@5.3.13
5.3.18
1
arturisimo/webapp-db-java:v2c95524e90b57
spring-beans@5.3.15
spring-webmvc@5.3.15
5.3.18
5.3.18
1
assistiot/cybersecurity-monitoring_id-elk:latestba1d85ec3739
spring-beans@5.2.5.RELEASE
5.2.20.RELEASE
1
atlassian/confluence-server:7.10.03b9222ab32ef
spring-beans@5.1.18.RELEASE
spring-webmvc@5.1.18.RELEASE
5.2.20.RELEASE
5.2.20.RELEASE
1
atlassian/jira-software:8.14.037bc46cbec1a
spring-beans@5.0.10.RELEASE
5.2.20.RELEASE
1
audig/clamapi:2.1.62c3fe34ee430
spring-beans@5.2.8.RELEASE
spring-boot-starter-web@2.3.2.RELEASE
spring-webmvc@5.2.8.RELEASE
5.2.20.RELEASE
2.5.12
5.2.20.RELEASE
1
beastob/url-shortener:1.0.299a49885ab33
spring-beans@5.3.10
spring-webmvc@5.3.10
5.3.18
5.3.18
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.