CVE-2021-22097 Deserialization of Untrusted Data in Spring AMQP
Attackers can cause 100% CPU usage and denial of service by triggering the toString method on malicious serialized messages in Spring AMQP.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-22097?
CVE-2021-22097 is a medium-severity denial of service vulnerability in Spring AMQP, published on 28 Oct 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.
Weakness: CWE-502
Which versions are affected by CVE-2021-22097?
4 open source packages ship an affected version, including org.springframework.amqp:spring-amqp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.amqp:spring-amqp Maven | From 2.2.0 | 2.2.19 |
org.springframework.amqp:spring-amqp Maven | From 2.2.0 | 2.2.19 |
org.springframework.amqp:spring-amqp Maven | From 2.3.0 | 2.3.11 |
org.springframework.amqp:spring-amqp Maven | From 2.3.0 | 2.3.11 |
Products include Vmware Spring Advanced Message Queuing Protocol.
How do I fix CVE-2021-22097?
Upgrade org.springframework.amqp:spring-amqp to a fixed version for your release line: 2.2.19 or 2.3.11.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-22097 being exploited?
There is no known exploitation of CVE-2021-22097 in the wild and no public exploit code.
Other vulnerabilities in Spring AMQP
- CVE-2026-59272 Log4j2 AmqpAppender disables TLS hostname verification by default
- CVE-2026-59275 Deserialization in Spring AMQP
- CVE-2026-59320 In Spring AMQP the link credit never replenished on listener exception path
- CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies
- CVE-2021-22095 Deserialization of Untrusted Data in Spring AMQP
Sources
Also known as CLSA-2026-1789453747, GHSA-fx7f-rjqj-52pj.