Spring4Shell CVE-2022-22965 class.module.classLoader Exploitation

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule monitors for HTTP POST requests containing 'class.module.classLoader', which is a characteristic payload component used to exploit the Spring4Shell vulnerability (CVE-2022-22965) in Spring Framework applications. This vulnerability allows for remote code execution (RCE) by manipulating class loader properties.