medium6.5
CVE-2021-22095
Deserialization of Untrusted Data in Spring AMQP
Impact
In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.amqp:spring-amqp | >= 2.3.0, <= 2.3.10 | 2.3.11 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Advanced Message Queuing Protocol | from 2.2.0 before 2.2.19 from 2.3.0 before 2.3.11 |