TI-2021-05098 Aliases CVE-2021-22095 GHSA-945q-ch46-pchg

Deserialization of untrusted data in Spring AMQP

LOW 31CWE-502Published 2021-11-30 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message

Why it matters now

EPSS 0.01052 64th percentileScored 2026-11-08

Fix Fixed org.springframework.amqp:spring-amqp (Maven): 2.2.20, 2.3.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Spring AMQP	Spring AMQP versions 2.2.X prior to 2.2.20 and 2.3.x prior to 2.3.12 .	—	No fix listed	CNA
—	org.springframework.amqp:spring-amqp (Maven)	2.2.0 to before 2.2.20	2.2.20	Patch available	GHSA-945q-ch46-pchg
—	org.springframework.amqp:spring-amqp (Maven)	2.3.0 to before 2.3.11	2.3.11	Patch available	GHSA-945q-ch46-pchg

Spring AMQP Vendor— Affected Spring AMQP versions 2.2.X prior to 2.2.20 and 2.3.x prior to 2.3.12 . Fixed in — No fix listed CNA
org.springframework.amqp:spring-amqp (Maven) Vendor— Affected 2.2.0 to before 2.2.20 Fixed in 2.2.20 Patch available GHSA-945q-ch46-pchg
org.springframework.amqp:spring-amqp (Maven) Vendor— Affected 2.3.0 to before 2.3.11 Fixed in 2.3.11 Patch available GHSA-945q-ch46-pchg

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol::::::::	2.2.0 to before 2.2.19; 2.3.0 to before 2.3.11	Vulnerable	VMware

cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.2.19; 2.3.0 to before 2.3.11 Vulnerable ·VMware

Remediation

Fix · GHSA-945q-ch46-pchg org.springframework.amqp:spring-amqp (Maven) Fixed in 2.2.20 Advisory →
Fix · GHSA-945q-ch46-pchg org.springframework.amqp:spring-amqp (Maven) Fixed in 2.3.11 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-22095
2026-10-03 Alias added: GHSA-945q-ch46-pchg

References

Advisory 2

Other 1

https://github.com/spring-projects/spring-amqp/commit/bde294d62a8b7f3f1d5a9f50f862c6f0782efb9d

TI-2016-01983 org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5… CVSS 3.1CRITICAL 9.8
TI-2026-42408 Deserialization of untrusted data in VMware Spring AMQP CVSS 3.1MEDIUM 6.6
TI-2026-42406 Log4j2 AmqpAppender disables TLS hostname verification by default CVSS 3.1MEDIUM 6.8
TI-2021-05100 Deserialization of untrusted data in Spring AMQP CVSS 3.1MEDIUM 6.5
TI-2026-42451 In Spring AMQP the link credit never replenished on listener exception path CVSS 3.1MEDIUM 6.5
TI-2026-42405 Admin password disclosed in BrokerNotAliveException message CVSS 3.1MEDIUM 6.5

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences