Is spring-ldap affected by Spring Framework RCE vulnerability CVE-2022-22965?

[LiveInDreams]

Is spring-ldap affected by Spring Framework RCE vulnerability CVE-2022-22965?
if so, will a new version be released?

https://spring.io/blog/2022/04/13/spring-framework-data-binding-rules-vulnerability-cve-2022-22968
https://nvd.nist.gov/vuln/detail/CVE-2022-22965

[jzheaux]

Spring LDAP 2.3.x does not use Framework's data-binding feature, though it is dependent on a version of Framework that contains the vulnerability. Following the advice in the CVE should suffice.

Spring LDAP 2.4.0 will release next week and include the updated Spring Framework dependency.

[LiveInDreams]

Thanks