CVE-2022-22969: 
Java vulnerability analysis and mitigation

Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. The vulnerability was discovered by Macchinetta/TERASOLUNA Framework Development Team and was disclosed on April 21, 2022 (VMware Tanzu, Spring Blog).

The vulnerability allows a malicious user or attacker to send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

This vulnerability specifically impacts OAuth 2.0 Client applications. When exploited, it can lead to system resource exhaustion through multiple authorization requests initiated from a single session, potentially causing a denial of service condition (VMware Tanzu).

Users of affected versions should upgrade to Spring Security OAuth version 2.5.2 or later. No other mitigation steps are necessary after the upgrade (VMware Tanzu).