RHLW-2026-80029b2333a1c4b6

See a problem?
Please try reporting it to the source first.

Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-80029b2333a1c4b6.json

Import Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-80029b2333a1c4b6.json

JSON Data

https://api.test.osv.dev/v1/vulns/RHLW-2026-80029b2333a1c4b6

Upstream

CVE (3)

GHSA (3)

Published

2026-10-12T16:59:46Z

Modified

2026-10-22T00:08:31Z

Severity

3.1 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

Lightwell Security Advisory: spring-context 5.3.18.rhlw-00010

Details

Red Hat Lightwell has released org.springframework:spring-context 5.3.18.rhlw-00010 with backported fixes for CVE-2022-22968, CVE-2024-38820, and CVE-2025-22233.

CVE-2022-22968: In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path.

CVE-2024-38820: CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception

CVE-2025-22233: CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and for request parameter names. However, there are still cases where it is possible to bypass the disallowedFields checks.

Affected Spring Products and Versions

Spring Framework:

6.2.0 - 6.2.6
6.1.0 - 6.1.19
6.0.0 - 6.0.27
5.3.0 - 5.3.42
Older, unsupported versions are also affected

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Affected version(s)Fix Version Availability 6.2.x 6.2.7 OSS6.1.x 6.1.20 OSS6.0.x 6.0.28 Commercial https://enterprise.spring.io/ 5.3.x 5.3.43 Commercial https://enterprise.spring.io/ No further mitigation steps are necessary.

Generally, we recommend using a dedicated model object with properties only for data binding, or using constructor binding since constructor arguments explicitly declare what to bind together with turning off setter binding through the declarativeBinding flag. See the Model Design section in the reference documentation.

For setting binding, prefer the use of allowedFields (an explicit list) over disallowedFields.

Credit

This issue was responsibly reported by the TERASOLUNA Framework Development Team from NTT DATA Group Corporation.

This patched artifact is a drop-in replacement for org.springframework:spring-context 5.3.18 from Maven Central.

References

Credits

- Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / org.springframework:spring-context

Package

Name: org.springframework:spring-context
Purl: pkg:maven/org.springframework/spring-context

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.3.18.rhlw-00010

Affected versions

1.*

1.0-m4

1.0-rc1

1.0

1.0.1

1.1-rc1

1.1-rc2

1.1

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.2-rc1

1.2-rc2

1.2

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.2.7

1.2.8

1.2.9

2.*

2.0-m1

2.0-m2

2.0-m3

2.0-m4

2.0-m5

2.0-rc1

2.0-rc2

2.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.5

2.5.1

2.5.2

2.5.3

2.5.4

2.5.5

2.5.6

2.5.6.SEC01

2.5.6.SEC02

2.5.6.SEC03

3.*

3.0.0.RELEASE

3.0.1.RELEASE

3.0.2.RELEASE

3.0.3.RELEASE

3.0.4.RELEASE

3.0.5.RELEASE

3.0.6.RELEASE

3.0.7.RELEASE

3.1.0.RELEASE

3.1.1.RELEASE

3.1.2.RELEASE

3.1.3.RELEASE

3.1.4.RELEASE

3.2.0.RELEASE

3.2.1.RELEASE

3.2.2.RELEASE

3.2.3.RELEASE

3.2.4.RELEASE

3.2.5.RELEASE

3.2.6.RELEASE

3.2.7.RELEASE

3.2.8.RELEASE

3.2.9.RELEASE

3.2.10.RELEASE

3.2.11.RELEASE

3.2.12.RELEASE

3.2.13.RELEASE

3.2.14.RELEASE

3.2.15.RELEASE

3.2.16.RELEASE

3.2.17.RELEASE

3.2.18.RELEASE

4.*

4.0.0.RELEASE

4.0.1.RELEASE

4.0.2.RELEASE

4.0.3.RELEASE

4.0.4.RELEASE

4.0.5.RELEASE

4.0.6.RELEASE

4.0.7.RELEASE

4.0.8.RELEASE

4.0.9.RELEASE

4.1.0.RELEASE

4.1.1.RELEASE

4.1.2.RELEASE

4.1.3.RELEASE

4.1.4.RELEASE

4.1.5.RELEASE

4.1.6.RELEASE

4.1.7.RELEASE

4.1.8.RELEASE

4.1.9.RELEASE

4.2.0.RELEASE

4.2.1.RELEASE

4.2.2.RELEASE

4.2.3.RELEASE

4.2.4.RELEASE

4.2.5.RELEASE

4.2.6.RELEASE

4.2.7.RELEASE

4.2.8.RELEASE

4.2.9.RELEASE

4.3.0.RELEASE

4.3.1.RELEASE

4.3.2.RELEASE

4.3.3.RELEASE

4.3.4.RELEASE

4.3.5.RELEASE

4.3.6.RELEASE

4.3.7.RELEASE

4.3.8.RELEASE

4.3.9.RELEASE

4.3.10.RELEASE

4.3.11.RELEASE

4.3.12.RELEASE

4.3.13.RELEASE

4.3.14.RELEASE

4.3.15.RELEASE

4.3.16.RELEASE

4.3.17.RELEASE

4.3.18.RELEASE

4.3.19.RELEASE

4.3.20.RELEASE

4.3.21.RELEASE

4.3.22.RELEASE

4.3.23.RELEASE

4.3.24.RELEASE

4.3.25.RELEASE

4.3.26.RELEASE

4.3.27.RELEASE

4.3.28.RELEASE

4.3.29.RELEASE

4.3.30.RELEASE

5.*

5.0.0.RELEASE

5.0.1.RELEASE

5.0.2.RELEASE

5.0.3.RELEASE

5.0.4.RELEASE

5.0.5.RELEASE

5.0.6.RELEASE

5.0.7.RELEASE

5.0.8.RELEASE

5.0.9.RELEASE

5.0.10.RELEASE

5.0.11.RELEASE

5.0.12.RELEASE

5.0.13.RELEASE

5.0.14.RELEASE

5.0.15.RELEASE

5.0.16.RELEASE

5.0.17.RELEASE

5.0.18.RELEASE

5.0.19.RELEASE

5.0.20.RELEASE

5.1.0.RELEASE

5.1.1.RELEASE

5.1.2.RELEASE

5.1.3.RELEASE

5.1.4.RELEASE

5.1.5.RELEASE

5.1.6.RELEASE

5.1.7.RELEASE

5.1.8.RELEASE

5.1.9.RELEASE

5.1.10.RELEASE

5.1.11.RELEASE

5.1.12.RELEASE

5.1.13.RELEASE

5.1.14.RELEASE

5.1.15.RELEASE

5.1.16.RELEASE

5.1.17.RELEASE

5.1.18.RELEASE

5.1.19.RELEASE

5.1.20.RELEASE

5.2.0.RELEASE

5.2.1.RELEASE

5.2.2.RELEASE

5.2.3.RELEASE

5.2.4.RELEASE

5.2.5.RELEASE

5.2.6.RELEASE

5.2.7.RELEASE

5.2.8.RELEASE

5.2.9.RELEASE

5.2.10.RELEASE

5.2.11.RELEASE

5.2.12.RELEASE

5.2.13.RELEASE

5.2.14.RELEASE

5.2.15.RELEASE

5.2.16.RELEASE

5.2.17.RELEASE

5.2.18.RELEASE

5.2.19.RELEASE

5.2.20.RELEASE

5.2.21.RELEASE

5.2.22.RELEASE

5.2.23.RELEASE

5.2.24.RELEASE

5.2.25.RELEASE

5.3.0

5.3.1

5.3.2

5.3.3

5.3.4

5.3.5

5.3.6

5.3.7

5.3.8

5.3.9

5.3.10

5.3.11

5.3.12

5.3.13

5.3.14

5.3.15

5.3.16

5.3.17

5.3.18

Database specific

lightwell

{
    "backport_base_version": "5.3.18",
    "remediated_version": "5.3.18.rhlw-00010",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}

source

"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-80029b2333a1c4b6.json"