Elastic's response to the Spring4Shell vulnerability (CVE-2022-22965)

This advisory outlines CVE-2022-22965 (Spring4Shell), a remote code execution vulnerability in the Spring Framework that can be exploited when applications run Spring MVC/WebFlux on JDK 9+ and are deployed as WARs on Apache Tomcat; it describes the affected versions, impact, available detection guidance (including Elastic detection rules), and recommends patching Spring or Tomcat and using configuration mitigations such as disallowedFields.