# Java Apm Agent - Spring4Shell

**URL:** https://discuss.elastic.co/t/java-apm-agent-spring4shell/301477
**Category:** APM
**Tags:** java
**Created:** [April 4, 2022, 9:03am UTC](https://discuss.elastic.co/t/java-apm-agent-spring4shell/301477 "2022-04-04T09:03:44Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Amar\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amar_sharma/32/103905_2.png) [@Amar\_Sharma](https://discuss.elastic.co/u/Amar_Sharma)
#### Post date: [April 4, 2022, 9:03am UTC](https://discuss.elastic.co/t/java-apm-agent-spring4shell/301477/1 "2022-04-04T09:03:44Z")

</div>

Hi Team ,

We are using APM Agent 1.28.1. We would like to know if this version is impacted by Spring Framework RCE vulnerability [CVE-2022-22965] - [https://tanzu.vmware.com/security/cve-2022-22965](https://tanzu.vmware.com/security/cve-2022-22965)

---

<div class="post-metadata">

### Author: ![Eyal\_Koren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eyal_koren/32/36830_2.png) [@Eyal\_Koren](https://discuss.elastic.co/u/Eyal_Koren)
#### Post date: [April 4, 2022, 9:38am UTC](https://discuss.elastic.co/t/java-apm-agent-spring4shell/301477/2 "2022-04-04T09:38:02Z")

</div>

Hi and welcome to our forum.

The Java agent doesn't use nor is shipped with any Spring dependency, so this vulnerability is related to your application dependencies, rather than the agent version.

Regardless, it is advisable to upgrade to 1.28.4 or higher, with regards to the Log4Shell vulnerability.

---

<div class="post-metadata">

### Author: ![Amar\_Sharma](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/amar_sharma/32/103905_2.png) [@Amar\_Sharma](https://discuss.elastic.co/u/Amar_Sharma)
#### Post date: [April 4, 2022, 9:59am UTC](https://discuss.elastic.co/t/java-apm-agent-spring4shell/301477/3 "2022-04-04T09:59:23Z")

</div>

Thank you @Eyal_Koren

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 25, 2022, 5:59am UTC](https://discuss.elastic.co/t/java-apm-agent-spring4shell/301477/4 "2022-04-25T05:59:53Z")

</div>

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.