CVE-2023-34050— Spring AMQP Deserialization Vulnerability
Quick assessment
Affected
Spring Spring AMQP
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Spring AMQP是将核心 Spring 概念应用于基于 AMQP 的消息传递解决方案的开发。 Spring AMQP 1.0.0 到2.4.16 、 3.0.0 到 3.0.9版本存在安全漏洞，该漏洞源于Spring AMQP 中添加了可反序列化类名的允许列表模式，允许用户锁定来自不受信任来源的消息中数据的反序列化。
Possible ATT&CK Techniques 1 AI
T1195 · Supply Chain Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-34050
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Spring AMQP Deserialization Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
In spring AMQP versions 1.0.0 to
2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class
names were added to Spring AMQP, allowing users to lock down deserialization of
data in messages from untrusted sources; however by default, when no allowed
list was provided, all classes could be deserialized.
Specifically, an application is
vulnerable if
* the
SimpleMessageConverter or SerializerMessageConverter is used
* the user
does not configure allowed list patterns
* untrusted
message originators gain permissions to write messages to the RabbitMQ
broker to send malicious content
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Spring AMQP 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Spring AMQP是将核心 Spring 概念应用于基于 AMQP 的消息传递解决方案的开发。 Spring AMQP 1.0.0 到2.4.16 、 3.0.0 到 3.0.9版本存在安全漏洞，该漏洞源于Spring AMQP 中添加了可反序列化类名的允许列表模式，允许用户锁定来自不受信任来源的消息中数据的反序列化。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring AMQP | 1.0.0 ~ 2.4.17 | - |
|
II. Public POCs for CVE-2023-34050
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | A Proof of Concept of Spring AMQP Deserialization Vulnerability (CVE-2023-34050) | https://github.com/X1r0z/spring-amqp-deserialization | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-34050
请登录查看更多情报信息。
Other References for CVE-2023-34050 (1)
IV. Related Vulnerabilities
Same vendor: Spring
-
CVE-2026-59318
DefaultToolCallingManager Global Resolver Fallback Allows Un -
CVE-2026-59308
Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Tru -
CVE-2026-59279
Unbounded persistent session allocation via repeated initial -
CVE-2026-59326
HTTP Proxy Credentials Logged in Plaintext by the Spring Boo -
CVE-2026-59328
Cross-Site Scripting in Eclipse Spring Boot Starter Wizard D
V. Comments for CVE-2023-34050
No comments yet