CVE-2023-34050 Spring AMQP Deserialization Vulnerability
Attackers can execute arbitrary code if untrusted users can send messages to a RabbitMQ broker using Spring AMQP without configured deserialization allowlists.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-34050?
CVE-2023-34050 is a medium-severity unsafe deserialization vulnerability in Spring AMQP, published on 19 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized.
Specifically, an application is vulnerable if
* the SimpleMessageConverter or SerializerMessageConverter is used
* the user does not configure allowed list patterns
* untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
Weakness: CWE-502
Which versions are affected by CVE-2023-34050?
It affects 1 product.
Products include Vmware Spring Advanced Message Queuing Protocol.
How do I fix CVE-2023-34050?
No fix has been published for CVE-2023-34050 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2023-34050 being exploited?
There is no known exploitation of CVE-2023-34050 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Spring AMQP
- CVE-2026-59272 Log4j2 AmqpAppender disables TLS hostname verification by default
- CVE-2026-59275 Deserialization in Spring AMQP
- CVE-2026-59320 In Spring AMQP the link credit never replenished on listener exception path
- CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies
- CVE-2021-22095 Deserialization of Untrusted Data in Spring AMQP
Sources
Also known as GHSA-24f5-5fmf-pwmc.