TI-2023-16916 Aliases CVE-2023-34050 GHSA-24f5-5fmf-pwmc

Spring AMQP Deserialization Vulnerability

LOW 27CWE-502Published 2023-10-19 · Updated 2024-09-12

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: None · Low · High
Fix status: Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-502.

Summary

In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01841 79th percentileScored 2026-11-07

Fix Partial Spring AMQP (Spring): 2.4.17, 3.0.10Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Spring AMQP	1.0.0 to before 2.4.17; 3.0.0 to before 3.0.10	2.4.17, 3.0.10	Patch available	CNA

Spring AMQP VendorVMware Affected 1.0.0 to before 2.4.17; 3.0.0 to before 3.0.10 Fixed in 2.4.17, 3.0.10 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol::::::::	1.0.0 to before 2.4.16; 3.0.0 to before 3.0.9	Vulnerable	VMware

cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:* Versions 1.0.0 to before 2.4.16; 3.0.0 to before 3.0.9 Vulnerable ·VMware

Remediation

Fix · CNA Spring AMQP (Spring) Fixed in 2.4.17, 3.0.10

Red Hat 1 advisory

RHSA-2023:7697 Released 2023-12-07 · Red Hat rating Moderate
AMQ Clients 2023.Q4
- Red Hat AMQ Clients

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
A-MQ Clients 2	Affected	No fix yet
Red Hat build of Apache Camel for Spring Boot 3	Affected	No fix planned: Will not fix
Red Hat AMQ Clients	Fixed	RHSA-2023:7697

Not affected: 2 products

A-MQ Clients 2
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2023-34050
2026-10-03 Alias added: GHSA-24f5-5fmf-pwmc

References

Advisory 1

https://spring.io/security/cve-2023-34050

TI-2016-01983 org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5… CVSS 3.1CRITICAL 9.8
TI-2026-42408 Deserialization of untrusted data in VMware Spring AMQP CVSS 3.1MEDIUM 6.6
TI-2026-42406 Log4j2 AmqpAppender disables TLS hostname verification by default CVSS 3.1MEDIUM 6.8
TI-2021-05100 Deserialization of untrusted data in Spring AMQP CVSS 3.1MEDIUM 6.5
TI-2021-05098 Deserialization of untrusted data in Spring AMQP CVSS 3.1MEDIUM 6.5
TI-2026-42451 In Spring AMQP the link credit never replenished on listener exception path CVSS 3.1MEDIUM 6.5

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences