Vulnerabilities > CVE-2021-22095 - Deserialization of Untrusted Data vulnerability in VMWare Spring Advanced Message Queuing Protocol

047910
CVSS 4.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
vmware
CWE-502
NVD
Published: 2021-11-30
Updated: 2021-12-01

Summary

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message

Vulnerable Configurations

Part Description Count
Application
Vmware
14

Common Weakness Enumeration (CWE)

References