CVE-2021-22097
In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.
| Software | From | Fixed in |
|---|---|---|
| vmware / spring_advanced_message_queuing_protocol | 2.2.0 | 2.2.18.x |
| vmware / spring_advanced_message_queuing_protocol | 2.3.0 | 2.3.10.x |
org.springframework.amqp / spring-amqp
|
2.2.0 | 2.2.19 |
|
org.springframework.amqp / spring-amqp
|
2.3.0 | 2.3.11 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime