CVE

CVE-2021-22053

8.8

CVSS

Description

Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.

Attack Vector

Privileges Req.

User Interaction

spring cloud netflix

Updated Oct 24, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

CVE-2021-22053 Scanner

CVE-2021-22053 scanner - Remote Code Execution (RCE) vulnerability in Spring Cloud Netflix

Used 3.4k times · 3.4k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →