{"id":"CVE-2021-22096","aliases":["GHSA-rfmp-97jj-h8m6"],"url":"https://o3.security/vulnerability/CVE-2021-22096","summary":"Improper Output Neutralization for Logs in Spring Framework","details":"In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.","published":"2021-10-28T16:15:07.733Z","modified":"2026-07-08T05:58:53.078028788Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.springframework:spring-core","fixedVersion":"5.3.11"},{"ecosystem":"Maven","name":"org.springframework:spring-core","fixedVersion":"5.2.18"},{"ecosystem":"Maven","name":"org.springframework:spring","fixedVersion":"5.2.18"},{"ecosystem":"Maven","name":"org.springframework:spring","fixedVersion":"5.3.11"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20211125-0005/"},{"type":"ADVISORY","url":"https://tanzu.vmware.com/security/cve-2021-22096"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:58:53.078028788Z"}}