CVE-2021-22095 Deserialization of Untrusted Data in Spring AMQP

Medium 6.5 Published 30 Nov 2021 Updated 3 Aug 2024

Attackers can cause denial of service by sending large messages that trigger out-of-memory errors in Spring AMQP applications.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-22095?

CVE-2021-22095 is a medium-severity denial of service vulnerability in Spring AMQP, published on 30 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message

Weakness: CWE-502

Which versions are affected by CVE-2021-22095?

4 open source packages ship an affected version, including org.springframework.amqp:spring-amqp. It affects 1 product.

Package	Affected	Fixed in
`org.springframework.amqp:spring-amqp` Maven	From `2.2.0`	`2.2.20`
`org.springframework.amqp:spring-amqp` Maven	From `2.2.0`	`2.2.20`
`org.springframework.amqp:spring-amqp` Maven	From `2.3.0`	`2.3.11`
`org.springframework.amqp:spring-amqp` Maven	From `2.3.0`	`2.3.11`

Products include Vmware Spring Advanced Message Queuing Protocol.

How do I fix CVE-2021-22095?

Upgrade org.springframework.amqp:spring-amqp to a fixed version for your release line: 2.2.20 or 2.3.11.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-22095 being exploited?

There is no known exploitation of CVE-2021-22095 in the wild and no public exploit code.

Sources

Also known as CLSA-2026-1793133237, CLSA-2026-1793133610, CLSA-2026-1793133848, GHSA-945q-ch46-pchg, UBUNTU-CVE-2021-22095.