← Vulnerability feed

Vulnerability record · CVE-2021-22097 · published 28 October 2021

CVE-2021-22097: Vmware spring advanced message queuing protocol deserialization of untrusted data vulnerability

Vmware · Spring Advanced Message Queuing Protocol

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.

6.5 CVSS 3.1 Medium EPSS 1.1% · top 36.5% CWE-502 · Deserialization of untrusted data
6.5CVSS 3.1 base score, v2 6.8
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://tanzu.vmware.com/security/cve-2021-22097 Vendor Advisory
https://tanzu.vmware.com/security/cve-2021-22097 Vendor Advisory

Track CVE-2021-22097 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2016-2173Fedoraproject fedora improper input validation vulnerabilityorg.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.EPSS 6.3%6.8CVE-2026-59272Vmware spring advanced message queuing protocol vulnerabilityAny application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interc…EPSS 0.27%6.5CVE-2026-59320Vmware spring advanced message queuing protocol vulnerabilityWhen a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consum…EPSS 0.42%6.5CVE-2026-59271Vmware spring advanced message queuing protocol error message information leak vulnerabilityWhen the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AM…EPSS 0.32%6.5CVE-2026-47860Vmware spring advanced message queuing protocol vulnerabilityAn attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 …EPSS 0.42%6.5CVE-2021-22095Vmware spring advanced message queuing protocol deserialization of untrusted data vulnerabilityIn Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object …EPSS 1.1%4.9CVE-2026-59275Vmware spring advanced message queuing protocol deserialization of untrusted data vulnerabilityA single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for ever…EPSS 0.45%4.3CVE-2023-34050Vmware spring advanced message queuing protocol deserialization of untrusted data vulnerabilityIn spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2021-22097), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.