PatchTheCVECVE-2021-22112: Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older un
53
This month
HIGH 8.8UPGRADEUPGRADEUPGRADE
CVE-2021-22112 is a high-severity flaw (CVSS 8.8) affecting spring security, spring security, communications element manager. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user cannot cause the bug to happen (it must be programmed in). However, if the application's intent is to only allow the user to run with elevated privileges in a small portion of the application, the bug can be leverag
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 3.3% (top 12%) |
| CISA exploited list | No |
| Published | 2021-02-23 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
pivotal software spring security UPGRADE
Affected: < 5.2.9 · >= 5.3.0 and < 5.3.8
Fixed in: 5.2.9, 5.3.8
Safe to downgrade to: a release before 5.3.0
1. Check installed version
apt-cache policy spring-security || rpm -q spring-security || spring-security --version
2. UPGRADE to 5.2.9 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade spring-security
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade spring-security
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 5.3.0 (Debian / Ubuntu)
apt-cache madison spring-security
sudo apt install spring-security=<VERSION_BEFORE_5.3.0>
sudo apt-mark hold spring-security
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list spring-security
sudo dnf downgrade spring-security-<VERSION_BEFORE_5.3.0>
sudo dnf versionlock add spring-security
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
vmware spring security UPGRADE
Affected: >= 5.4.0 and < 5.4.4
Fixed in: 5.4.4
Safe to downgrade to: a release before 5.4.0
1. Check installed version
apt-cache policy spring-security || rpm -q spring-security || spring-security --version
2. UPGRADE to 5.4.4 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade spring-security
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade spring-security
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 5.4.0 (Debian / Ubuntu)
apt-cache madison spring-security
sudo apt install spring-security=<VERSION_BEFORE_5.4.0>
sudo apt-mark hold spring-security
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list spring-security
sudo dnf downgrade spring-security-<VERSION_BEFORE_5.4.0>
sudo dnf versionlock add spring-security
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle communications element manager UPGRADE
Affected: >= 8.2.0 and <= 8.2.4.0
Fixed in: newer than 8.2.4.0
Safe to downgrade to: a release before 8.2.0
1. Check installed version
apt-cache policy communications-element-manager || rpm -q communications-element-manager || communications-element-manager --version
2. UPGRADE to newer than 8.2.4.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade communications-element-manager
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade communications-element-manager
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 8.2.0 (Debian / Ubuntu)
apt-cache madison communications-element-manager
sudo apt install communications-element-manager=<VERSION_BEFORE_8.2.0>
sudo apt-mark hold communications-element-manager
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list communications-element-manager
sudo dnf downgrade communications-element-manager-<VERSION_BEFORE_8.2.0>
sudo dnf versionlock add communications-element-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle communications interactive session recorder DOWNGRADE
Affected: 6.3 · 6.4
Fixed in: no fixed release known
Safe to downgrade to: a release before 6.3
1. Check installed version
apt-cache policy communications-interactive-session-recorder || rpm -q communications-interactive-session-recorder || communications-interactive-session-recorder --version
2. No fixed release: DOWNGRADE to a release before 6.3 (Debian / Ubuntu)
apt-cache madison communications-interactive-session-recorder
sudo apt install communications-interactive-session-recorder=<VERSION_BEFORE_6.3>
sudo apt-mark hold communications-interactive-session-recorder
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list communications-interactive-session-recorder
sudo dnf downgrade communications-interactive-session-recorder-<VERSION_BEFORE_6.3>
sudo dnf versionlock add communications-interactive-session-recorder
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle communications unified inventory management DOWNGRADE
Affected: 7.4.1
Fixed in: no fixed release known
Safe to downgrade to: a release before 7.4.1
1. Check installed version
apt-cache policy communications-unified-inventory-management || rpm -q communications-unified-inventory-management || communications-unified-inventory-management --version
2. No fixed release: DOWNGRADE to a release before 7.4.1 (Debian / Ubuntu)
apt-cache madison communications-unified-inventory-management
sudo apt install communications-unified-inventory-management=<VERSION_BEFORE_7.4.1>
sudo apt-mark hold communications-unified-inventory-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list communications-unified-inventory-management
sudo dnf downgrade communications-unified-inventory-management-<VERSION_BEFORE_7.4.1>
sudo dnf versionlock add communications-unified-inventory-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle hospitality cruise shipboard property management system DOWNGRADE
Affected: 20.1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 20.1.0
1. Check installed version
apt-cache policy hospitality-cruise-shipboard-property-management-system || rpm -q hospitality-cruise-shipboard-property-management-system || hospitality-cruise-shipboard-property-management-system --version
2. No fixed release: DOWNGRADE to a release before 20.1.0 (Debian / Ubuntu)
apt-cache madison hospitality-cruise-shipboard-property-management-system
sudo apt install hospitality-cruise-shipboard-property-management-system=<VERSION_BEFORE_20.1.0>
sudo apt-mark hold hospitality-cruise-shipboard-property-management-system
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list hospitality-cruise-shipboard-property-management-system
sudo dnf downgrade hospitality-cruise-shipboard-property-management-system-<VERSION_BEFORE_20.1.0>
sudo dnf versionlock add hospitality-cruise-shipboard-property-management-system
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-22112?
spring security: upgrade to 5.2.9, 5.3.8; spring security: upgrade to 5.4.4; communications element manager: upgrade to newer than 8.2.4.0. Exact commands for each OS are on this page.
Is CVE-2021-22112 being exploited?
CVE-2021-22112 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-22112 affect?
CVE-2021-22112 affects spring security, spring security, communications element manager. Severity is high (CVSS 8.8). Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityContext if it is changed more than once in a single request.A malicious user canno
How urgent is CVE-2021-22112?
Priority 53/100. High severity
Software pages
Related CVEs
- CVE-2026-22754 HIGH 7.5 UPGRADE Vulnerability in Spring Spring Security
- CVE-2026-22753 HIGH 7.5 UPGRADE Vulnerability in Spring Spring Security
- CVE-2026-22747 MEDIUM 6.8 UPGRADE Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malfo
- CVE-2026-22746 LOW 3.7 UPGRADE Vulnerability in Spring Spring Security
- CVE-2026-22751 MEDIUM 4.8 UPGRADE Vulnerability in Spring Spring Security