Bypass Vulnerability in Spring Framework Affecting Multiple Versions

CVE-2025-22233

What is CVE-2025-22233?

The vulnerability allows unauthorized bypass of security checks surrounding disallowedFields patterns and request parameter names in the Spring Framework. Despite previous enhancements for locale-independent, lowercase conversions, certain scenarios can still exploit these checks, potentially leading to unauthorized data binding. It is critical for users operating on affected versions ranging from 5.3.x to 6.2.x to upgrade to the specified fixed versions. Implementing best practices, such as using a dedicated model object for data binding and switching from disallowedFields to an allowedFields list, is highly advised to enhance security.

References