TI-2021-05100 Aliases CVE-2021-22097 GHSA-fx7f-rjqj-52pj

Deserialization of untrusted data in Spring AMQP

LOW 31CWE-502Published 2021-10-28 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.

Why it matters now

EPSS 0.01071 65th percentileScored 2026-11-07

Fix Fixed org.springframework.amqp:spring-amqp (Maven): 2.2.19, 2.3.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	Spring AMQP	Spring AMQP versions 2.2.X prior to 2.2.19 and 2.3.x prior to 2.3.11 .	—	No fix listed	CNA
—	org.springframework.amqp:spring-amqp (Maven)	2.2.0 to before 2.2.19	2.2.19	Patch available	GHSA-fx7f-rjqj-52pj
—	org.springframework.amqp:spring-amqp (Maven)	2.3.0 to before 2.3.11	2.3.11	Patch available	GHSA-fx7f-rjqj-52pj

Spring AMQP Vendor— Affected Spring AMQP versions 2.2.X prior to 2.2.19 and 2.3.x prior to 2.3.11 . Fixed in — No fix listed CNA
org.springframework.amqp:spring-amqp (Maven) Vendor— Affected 2.2.0 to before 2.2.19 Fixed in 2.2.19 Patch available GHSA-fx7f-rjqj-52pj
org.springframework.amqp:spring-amqp (Maven) Vendor— Affected 2.3.0 to before 2.3.11 Fixed in 2.3.11 Patch available GHSA-fx7f-rjqj-52pj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol::::::::	2.2.0 – 2.2.18; 2.3.0 – 2.3.10	Vulnerable	VMware

cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:* Versions 2.2.0 – 2.2.18; 2.3.0 – 2.3.10 Vulnerable ·VMware

Remediation

Fix · GHSA-fx7f-rjqj-52pj org.springframework.amqp:spring-amqp (Maven) Fixed in 2.2.19 Advisory →
Fix · GHSA-fx7f-rjqj-52pj org.springframework.amqp:spring-amqp (Maven) Fixed in 2.3.11 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-22097
2026-10-03 Alias added: GHSA-fx7f-rjqj-52pj

References

Advisory 2

TI-2016-01983 org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5… CVSS 3.1CRITICAL 9.8
TI-2026-42408 Deserialization of untrusted data in VMware Spring AMQP CVSS 3.1MEDIUM 6.6
TI-2026-42406 Log4j2 AmqpAppender disables TLS hostname verification by default CVSS 3.1MEDIUM 6.8
TI-2021-05098 Deserialization of untrusted data in Spring AMQP CVSS 3.1MEDIUM 6.5
TI-2026-42451 In Spring AMQP the link credit never replenished on listener exception path CVSS 3.1MEDIUM 6.5
TI-2026-42405 Admin password disclosed in BrokerNotAliveException message CVSS 3.1MEDIUM 6.5

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences