Spring Cloud Framework Vulnerabilities

**Zscaler ThreatLabz advisory:** Two vulnerabilities affecting Spring components are detailed: CVE-2022-22963 (medium severity SpEL expression/resource access issue in Spring Cloud Function that can be triggered via the spring.cloud.function.routing-expression HTTP header) and CVE-2022-22965 (Spring4Shell, a critical unauthenticated RCE in Spring Framework on JDK9+ under certain servlet/container configurations). The report lists impacted versions, patched releases (Spring Cloud Function 3.1.7/3.2.3; Spring Framework 5.3.18+/5.2.20+), mitigation guidance, recommended best practices, and Zscaler protections for known proofs-of-concept.