CVE-2016-2173
Improper Input Validation in Spring AMQP
CVE-2016-2173 is a critical vulnerability (CVSS 9.8) in Fedoraproject Fedora, published April 21, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.28%, the 93rd percentile. Fixed in org.springframework.amqp:spring-amqp 1.5.5.
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
- Record
CVE-2016-2173- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
- Record
CVE-2016-2173- Updated
- 2026-11-02
EUVDEUVD-2022-4210 No score
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
- Record
EUVD-2022-4210- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hrp3-8p5w-27gv
Improper Input Validation in Spring AMQP
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
- Record
GHSA-hrp3-8p5w-27gv- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
- Record
CVE-2016-2173- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-hrp3-8p5w-27gv
Improper Input Validation in Spring AMQP
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
- Record
GHSA-hrp3-8p5w-27gv- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.amqp:spring-amqpMaven |
through 1.5.4 | 1.5.5 |
org.springframework.amqp:spring-amqpMaven |
before 1.5.5, plus listed versions 1.0.0.RELEASE1.1.0.RELEASE1.1.1.RELEASE1.1.2.RELEASE1.1.3.RELEASE Show 26 moreShow less1.1.4.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.3.9.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.2.RELEASE1.5.3.RELEASE1.5.4.RELEASE |
1.5.5 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | HaToan/CVE-2016-2173 | 2017-03-29 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
lists.fedoraproject.org/pipermail/package-announce/2016-April/182959.html
pivotal.io/security/cve-2016-2173
bugzilla.redhat.com/show_bug.cgi?id=1326205
nvd.nist.gov/vuln/detail/CVE-2016-2173
github.com/advisories/GHSA-hrp3-8p5w-27gv