CVE-2021-22097

Published: Oct 28, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.

Affected (2)

Products: Vmware: Spring Advanced Message Queuing Protocol

1 product

Spring Advanced Message Queuing Protocol

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Advanced Message Queuing Protocol	From 2.2.0 to 2.2.18
Vmware Spring Advanced Message Queuing Protocol	From 2.3.0 to 2.3.10

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://tanzu.vmware.com/security/cve-2021-22097

Source: security@vmware.com

Vendor Advisory

https://tanzu.vmware.com/security/cve-2021-22097

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.