[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What the Heck is Spring4Shell? The 2min Explanation We All Need](/blog/what-is-spring4shell) Publish date November 19, 2024 {x} minute read # What the Heck is Spring4Shell? The 2min Explanation We All Need [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Edward Kost](/team/edward-kost) Senior Cybersecurity Writer Edward is a cyber writer with a mechanical engineering background. His work has been referenced by academic institutions and government bodies. Reviewed by [Steve Harrison](/team/steve-harrison) Vice President, Product Support Table of contents Free resource ### [Download now](#) As the digital world continues to rebuild after the [Log4j hurricane](https://www.upguard.com/blog/apache-log4j-vulnerability), the threat landscape is once again disturbed by the rumbling of an approaching [zero-day](https://www.upguard.com/blog/zero-day) storm. After barely recovering from a zero-day dubbed as [the worst hack ever encountered](https://news.trendmicro.com/2021/12/14/log4shell-the-worst-bug-in-a-decade-affecting-everyone-including-google-apple-amazon-and-netflix/), concerns are understandably heightened, and as a result, there are many misconceptions about the severity of Spring4Shell. This post addresses the common misunderstandings of Spring4Shell and offers a high-speed overview of the zero-day for those that don't have time for an in-depth technical analysis. ## What is Spring4Shell? Spring4Shell is a [vulnerability](https://www.upguard.com/blog/vulnerability) in VMWare’s Spring Core Java framework - an open-source platform for developing Java applications. Spring is a highly-popular framework with [60% of Java developers](https://snyk.io/blog/spring-dominates-the-java-ecosystem-with-60-using-it-for-their-main-applications/) depending on it for the production of their applications. Because of the framework’s dominance in the Java ecosystem, many applications could potentially be impacted by the Spring4Shell zero-day.  In comparison, the Log4J framework is used by almost all Java-based web apps and cloud services, so though Spring4Shell is categorized as a critical vulnerability, it's still significantly less dangerous than Log4Shell.  The Spring4Shell vulnerability is being tracked as [CVE-2022-22965](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965). ## What is the Impact of Spring4Shell? To understand the potential impacts of Spring4Shell it helps to first understand how the Spring Core Java framework works.  Spring Core (often abbreviated as *Spring*) simplifies parameter extraction requests on an Apache Tomcat server or Java server In other words, Spring makes writing and testing code easier by allowing developers to [map user requests to Java objects](https://www.dynatrace.com/news/blog/anatomy-of-spring4shell-vulnerability/). The Spring4Shell vulnerability allows attackers to exploit this pathway, making all connected applications vulnerable to Remote Code Execution (RCE). > Remote Code Injection (RCE) is a form of cyberattack where hackers remotely inject malicious code into a compromised machine. An RCE can be established by simply sending a malicious query to a web server running on a vulnerable version of Spring. Once established, the RCE attack vector opens multiple avenues for further [cyberattacks](https://www.upguard.com/blog/cyber-attack) including:  * Access to all internal website data * Access to all backend website resources * Access to all networked databases * Access to resources hosting privileged credentials Because Spring4Shell has the potential of facilitating RCE attacks, it was assigned [a CVSS score of 9.8](https://nvd.nist.gov/vuln/detail/CVE-2022-22965), which gives it a *Critical* security rating.   > According to a report by CheckPoint, 16% of organizations worldwide impacted by Spring4Shell experienced exploitation attempts within the first 4 days of the zero-day’s discovery ## Is Spring4Shell as Dangerous as Log4Shell? The primary differentiator between Log4Shell and Spring4Shell is that most Log4j users were unaware that they were impacted by the vulnerability. Log4j is often bundled up deep inside an application because it's a component deployed within other tools and libraries used in the Java development process. Spring4Shell, on the other hand, is not so easily hidden. The Spring is a development framework so users can easily identify if they’re impacted by the vulnerability/ The other reason why Spring4Shell isn’t as dangerous as Log4Shell is that multiple conditions need to be met in order for Spring4Shell to be exploitable. You are in danger of a Spring4Shell cyberattack if you’re using: * Spring [Web MVC](https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html) or [Spring Webflux](https://docs.spring.io/spring/docs/current/spring-framework-reference/web-reactive.html) projects AND  * Spring Framework version 5.3.x prior to 5.3.18, and all versions prior to 5.2.20 AND  * Java 9 Runtime Environment or above, regardless of the language version the application is compiled for  AND  * Deployed on Tomcat App Server as a WAR AND  * Spring Web MVC with parameter binding (enabled by default) AND  * Don’t have an allowlist of HTTP fields registered to be [allowed](https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/validation/DataBinder.html#setAllowedFields-java.lang.String...-) or explicitly [disallow](https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/validation/DataBinder.html#setDisallowedFields-java.lang.String...-) fields that could cause malicious intent. With Log4shell, you could force any java code to download and run. With Spring4Shell, you need to work with the java classes that already exist on the server. Currently, the only known exploit requires Tomcat to be running Spring, as the Tomcat logging java classes can be used to launch an attack. This could change if ongoing investigations confirm that Spring4Shell can also be exploited in other sever environments. ## How to Respond if you’re Impacted by Spring4Shell The best response is to upgrade to the latest patched Spring Framework versions - 5.3.18 and 5.2.20. If upgrading is not a possibility, you can [follow Spring’s suggest workaround process](https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement#suggested-workarounds).  Even if you don’t meet all of the conditions for exploitation, upgrading to the latest versions of Spring is highly recommended. It’s important to note that though the current known exploit occurs on Tomcat servers that doesn’t mean the zero-day is limited to this environment. Spring4Shell is still a new vulnerability so there may be other methods of exploitation that haven't been discovered yet. Updating to the latest versions of Spring will give you the highest chances of protection if additional exploit methods are eventually discovered (fingers crossed).\ ‍ [Click here](https://www.upguard.com/instant-security-score) to request your free instant security score. ‍ ‍ ‍ Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) October 29, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)