CVE-2023-34050 - CVE House
Back to Database
Status published Medium CVE-2023-34050

Spring AMQP Deserialization Vulnerability

Vulnerability Description

In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-34050

Credits & Attribution

No credits recorded in the NVD database.

References

More from Spring

View All →
CVE-2025-41243
Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
Critical 10
CVE-2025-41232
CVE-2025-41232: Spring Security authorization bypass for method security annotations on private methods
Critical 9.1
CVE-2025-22235
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
High 7.3
CVE-2025-22234
Spring Security - BCrypt Password Encoder maximum password length breaks timing attack mitigation
Medium 5.3
CVE-2025-22233
Spring Framework DataBinder Case Sensitive Match Exception
Low 3.1

Affected Vendor

Affected Software

Spring AMQP
Vulnerable Versions:
1.0.0, 3.0.0

Timeline

Official Publish: October 19th, 2023
Last Modified: September 12th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.