# Spring4Shell ::Spring Framework Remote Code Execution Vulnerability

**URL:** <https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229>\
**Category:** Elasticsearch\
**Created:** [March 31, 2022, 5:09pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229 "2022-03-31T17:09:20Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vishnu\_Vijay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishnu_vijay/32/100047_2.png) [@Vishnu\_Vijay](https://discuss.elastic.co/u/Vishnu_Vijay)\
**Post date:** [March 31, 2022, 5:09pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229/1 "2022-03-31T17:09:20Z")

</div>

Hello,

We are using Elasticsearch 6.3.2 & 6.8.23

Please let us know, whether ES is using spring boot war and whether Elasticsearch is impacted any way by the reported spring shell vulnerability.

Please suggest, whether we need to take any steps from our end for mitigating the same

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [March 31, 2022, 5:24pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229/2 "2022-03-31T17:24:23Z")

</div>

ES does not use Spring Boot.

> We are using Elasticsearch 6.3.2

You should really upgrade this version.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 31, 2022, 5:24pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229/3 "2022-03-31T17:24:23Z")

</div>

Elasticsearch 6.3 is [EOL](https://www.elastic.co/support/eol) and no longer supported. Please upgrade ASAP.

(This is an automated response from your friendly Elastic bot. Please report this post if you have any suggestions or concerns :elasticheart: )

---

<div class="post-metadata">

**Author:** ![Vishnu\_Vijay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishnu_vijay/32/100047_2.png) [@Vishnu\_Vijay](https://discuss.elastic.co/u/Vishnu_Vijay)\
**Post date:** [April 1, 2022, 7:39am UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229/4 "2022-04-01T07:39:51Z")

</div>

Thanks 🙂

---

<div class="post-metadata">

**Author:** ![anon90868141](https://avatars.discourse-cdn.com/v4/letter/a/7ab992/32.png) [@anon90868141](https://discuss.elastic.co/u/anon90868141)\
**Post date:** [April 1, 2022, 8:26am UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229/5 "2022-04-01T08:26:40Z")

</div>

Will there be any official statement from Elastic concerning Spring4Shell or is it not needed because ES doesn't use spring at all?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2022, 8:26am UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229/6 "2022-04-29T08:26:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 3, 2022, 11:55pm UTC](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229/7 "2022-05-03T23:55:49Z")

</div>

Please consider [the marked solution](https://discuss.elastic.co/t/spring4shell-spring-framework-remote-code-execution-vulnerability/301229/22) as the official stance on this.