CVE-2023-34050
Spring AMQP Deserialization Vulnerability
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized.
Specifically, an application is vulnerable if
-
the SimpleMessageConverter or SerializerMessageConverter is used
-
the user does not configure allowed list patterns
-
untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Spring AMQP Deserialization Vulnerability
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized.
Specifically, an application is vulnerable if
-
the SimpleMessageConverter or SerializerMessageConverter is used
-
the user does not configure allowed list patterns
-
untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
- Record
CVE-2023-34050- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
EUVDEUVD-2023-38167
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized.
Specifically, an application is vulnerable if
-
the SimpleMessageConverter or SerializerMessageConverter is used
-
the user does not configure allowed list patterns
-
untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
- Record
EUVD-2023-38167- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-24f5-5fmf-pwmc
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for...
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized.
Specifically, an application is vulnerable if
-
the SimpleMessageConverter or SerializerMessageConverter is used
-
the user does not configure allowed list patterns
-
untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
- Record
GHSA-24f5-5fmf-pwmc- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized.
Specifically, an application is vulnerable if
-
the SimpleMessageConverter or SerializerMessageConverter is used
-
the user does not configure allowed list patterns
-
untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
- Record
CVE-2023-34050- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Spring AMQP Deserialization Vulnerability
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized.
Specifically, an application is vulnerable if
-
the SimpleMessageConverter or SerializerMessageConverter is used
-
the user does not configure allowed list patterns
-
untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
- Record
CVE-2023-34050- CVSS 3.1
- 5.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | X1r0z/spring-amqp-deserialization | 2023-10-20 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-34050 is a medium vulnerability (CVSS 5.0) in Spring Amqp, published October 19, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. No source names a fixed version.