Attempting to create a large array in a SpEL expression can result in an OutOfMemoryError
. Although the JVM recovers from that, we should throw an exception with a meaningful error message in order to improve diagnostics for the user.
Comment From: artem-smotrakov
Hi @sbrannen Does this address CVE-2022-22963?
Comment From: sbrannen
Does this address CVE-2022-22963?
No. That CVE is specific to Spring Cloud Function. See the corresponding blog post for details.
Comment From: artem-smotrakov
@sbrannen Oh sorry, I meant CVE-2022-22950 in Spring Framework. Does this commit address CVE-2022-22950?