# Springshell Vulnerability Update **URL:** \ **Category:** Community Announcements\ **Tags:** springshell\ **Created:** [March 31, 2022, 4:11pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453 "2022-03-31T16:11:07Z")\ **Posts on this page:** 1\ **Showing post:** 1
**Author:** ![mfrost](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/mfrost/32/1701_2.png) [@mfrost](https://community.sonatype.com/u/mfrost)\ **Post date:** [March 31, 2022, 4:11pm UTC](https://community.sonatype.com/t/springshell-vulnerability-update/8453/1 "2022-03-31T16:11:07Z")
Hi Sonatype Community, Early Wednesday morning (GMT), allegations began to appear on the Internet about a new remote code execution flaw that affects **Spring Framework**. This vulnerability, dubbed by some as “Springshell” in the community, is a new, previously unknown security vulnerability. The vulnerability affects the **spring-beans** and **spring** artifacts, an extremely popular framework used widely in Java applications, and seems to require JDK9 or newer to be running. It is a bypass for an older CVE, CVE-2010-1622 that due to a feature in JDK9 or newer seems to have been reinstated. The vulnerability was confirmed on Wednesday and It has been added to Sonatype data as **SONATYPE-2022-1764** and given the designation **CVE-2022-22965**. Spring has acknowledged the vulnerability and released **5.3.18** and **5.2.20** to patch the issue. **We recommend an immediate upgrade for all users.** Customers who have scanned their applications with Nexus Lifecycle will receive **automatic security alerts** as a part of their usual continuous monitoring. If you have Continuous Monitoring turned on, you are protected. **UPDATE:** Sonatype solutions are not affected by the Spring4shell vulnerability. **Unsure if your organization is impacted?** See our [Find & Fix Springshell guide](https://bit.ly/36CKYwJ) for help as you investigate your applications and environments for this vulnerability. For continuing updates and additional information, please visit [this Sonatype blog post](https://blog.sonatype.com/new-0-day-spring-framework-vulnerability-confirmed). * * * If you have any additional questions, we are happy to answer them in the thread below. --- _[View the full topic](https://community.sonatype.com/t/springshell-vulnerability-update/8453)._