CVE-2023-34040 Java Deserialization vulnerability in Spring-Kafka When Improperly Configured
Attackers can execute arbitrary code via malicious serialized objects in Kafka headers if specific non-default deserialization settings are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34040?
CVE-2023-34040 is a medium-severity unsafe deserialization vulnerability in Spring For Apache Kafka, published on 24 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.
Specifically, an application is vulnerable when all of the following are true:
* The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record * The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true. * The user allows untrusted sources to publish to a Kafka topic
By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.
Weakness: CWE-502
Which versions are affected by CVE-2023-34040?
4 open source packages ship an affected version, including org.springframework.kafka:spring-kafka. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.kafka:spring-kafka Maven | From 2.8.1 | 2.9.11 |
org.springframework.kafka:spring-kafka Maven | From 2.8.1 | 2.9.11 |
org.springframework.kafka:spring-kafka Maven | From 3.0.0 | 3.0.10 |
org.springframework.kafka:spring-kafka Maven | From 3.0.0 | 3.0.10 |
Products include Vmware Spring for Apache Kafka.
How do I fix CVE-2023-34040?
Upgrade org.springframework.kafka:spring-kafka to a fixed version for your release line: 2.9.11 or 3.0.10.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-34040 being exploited?
There is no known exploitation of CVE-2023-34040 in the wild and no public exploit code.
Public exploit code: 4 proofs of concept on GitHub.
Other vulnerabilities in Spring For Apache Kafka
- CVE-2026-59278 Server-side request forgery in Spring for Apache Kafka
- CVE-2026-59317 Denial of service in Spring for Apache Kafka
- CVE-2026-41726 In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
- CVE-2026-41727 In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior
Sources
Also known as GHSA-crqf-q9fp-hwjw.