CVE-2021-22119: oracle communications_cloud_native_core_policy Uncontrolled Resource Consumption
Vulnerability summary
CVE-2021-22119 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in oracle communications_cloud_native_core_policy. EPSS estimates a 6.00% chance of exploitation in the next 30 days, higher than 93.2% of scored vulnerabilities.
Timeline
- 29-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
6.00%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
0.00 pp
From 6.00% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Org.springframework.security2 products
- spring-security-core≥ 5.5.0, < 5.5.1 | ≥ 5.4.0, < 5.4.7 | ≥ 5.3.0, < 5.3.10 | ≥ 5.2.0, < 5.2.11
- spring-security-oauth2-client≥ 5.5.0, < 5.5.1 | ≥ 5.4.0, < 5.4.7 | ≥ 5.3.0, < 5.3.10 | ≥ 5.2.0, < 5.2.11
Oracle1 product
Vmware1 product
- spring_security≥ 5.2.0, < 5.2.11 | ≥ 5.3.0, < 5.3.10 | ≥ 5.4.0, < 5.4.7 | ≥ 5.5.0, < 5.5.1
3 vendors · 4 products
