VulnerableCode Package Details - pkg:maven/org.springframework/spring-messaging@4.3.11.RELEASE

Search for packages

Vulnerability	Summary	Fixed by
VCID-8cpe-j15y-jbdk Aliases: CVE-2022-22971 GHSA-rqph-vqwm-22vc	In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.	5.2.22.RELEASE Affected by 0 other vulnerabilities. 5.3.20 Affected by 0 other vulnerabilities.
VCID-ndek-xah6-47d2 Aliases: CVE-2020-5421 GHSA-rv39-3qh7-9v7w	In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.	4.3.28.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 4.3.29.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.0.18.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.0.19.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.1.17.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.1.18.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.2.8.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.2.9.RELEASE Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-rfx3-r9qs-dkhg Aliases: CVE-2018-1257 GHSA-rcpf-vj53-7h2m		4.3.17.RELEASE Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 5.0.6.RELEASE Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-8cpe-j15y-jbdk
Aliases:
CVE-2022-22971
GHSA-rqph-vqwm-22vc

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.

5.2.22.RELEASE
Affected by 0 other vulnerabilities.

5.3.20
Affected by 0 other vulnerabilities.

VCID-ndek-xah6-47d2
Aliases:
CVE-2020-5421
GHSA-rv39-3qh7-9v7w

In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.

4.3.28.RELEASE
Affected by 1 other vulnerability.

4.3.29.RELEASE
Affected by 1 other vulnerability.

5.0.18.RELEASE
Affected by 1 other vulnerability.

5.0.19.RELEASE
Affected by 1 other vulnerability.

5.1.17.RELEASE
Affected by 1 other vulnerability.

5.1.18.RELEASE
Affected by 1 other vulnerability.

5.2.8.RELEASE
Affected by 1 other vulnerability.

5.2.9.RELEASE
Affected by 1 other vulnerability.

VCID-rfx3-r9qs-dkhg
Aliases:
CVE-2018-1257
GHSA-rcpf-vj53-7h2m

4.3.17.RELEASE
Affected by 2 other vulnerabilities.

5.0.6.RELEASE
Affected by 2 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-12T18:10:09.804371+00:00	GitLab Importer	Affected by	VCID-8cpe-j15y-jbdk	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-messaging/CVE-2022-22971.yml	38.6.0
2026-06-12T17:27:53.657610+00:00	GitLab Importer	Affected by	VCID-ndek-xah6-47d2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-messaging/CVE-2020-5421.yml	38.6.0
2026-06-12T16:59:06.554502+00:00	GitLab Importer	Affected by	VCID-rfx3-r9qs-dkhg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework/spring-messaging/CVE-2018-1257.yml	38.6.0