Spring4Shell
CVE-2022-22965 — RCE in Spring Framework via classloader manipulation in data binding. Java 9+ feature interaction caused the vulnerability.
Disclosed 30 March 2022. Brief initial panic ("next Log4Shell!") but turned out to be much narrower scope — required specific Tomcat + Spring + JDK 9+ config. Patched the same day in 5.3.18 and 5.2.20. Cousin: Spring Cloud Function RCE (CVE-2022-22963) found simultaneously.