Search for packages
| purl | pkg:maven/org.springframework/spring-messaging@4.1.7.RELEASE |
| Next non-vulnerable version | 5.2.22.RELEASE |
| Latest non-vulnerable version | 5.3.20 |
| Risk | 3.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-8cpe-j15y-jbdk
Aliases: CVE-2022-22971 GHSA-rqph-vqwm-22vc |
In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-ndek-xah6-47d2
Aliases: CVE-2020-5421 GHSA-rv39-3qh7-9v7w |
In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-12T18:10:09.700812+00:00 | GitLab Importer | Affected by | VCID-8cpe-j15y-jbdk | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-messaging/CVE-2022-22971.yml | 38.6.0 |
| 2026-06-12T17:27:53.541856+00:00 | GitLab Importer | Affected by | VCID-ndek-xah6-47d2 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-messaging/CVE-2020-5421.yml | 38.6.0 |