Deserialization of Untrusted Data in Spring AMQP

2021-12-0100:00:40

Google

osv.dev

0.001 Low

EPSS

Percentile

35.0%

JSON

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message

CPENameOperatorVersion
org.springframework.amqp:spring-amqpeq2.3.0
org.springframework.amqp:spring-amqpeq2.2.0.RELEASE
org.springframework.amqp:spring-amqpeq2.2.5.RELEASE
org.springframework.amqp:spring-amqpeq2.3.9
org.springframework.amqp:spring-amqpeq2.2.2.RELEASE
org.springframework.amqp:spring-amqpeq2.2.1.RELEASE
org.springframework.amqp:spring-amqpeq2.2.17.RELEASE
org.springframework.amqp:spring-amqpeq2.3.8
org.springframework.amqp:spring-amqpeq2.2.4.RELEASE
org.springframework.amqp:spring-amqpeq2.2.11.RELEASE

Name	Operator	Version
org.springframework.amqp:spring-amqp	eq	2.3.0
org.springframework.amqp:spring-amqp	eq	2.2.0.RELEASE
org.springframework.amqp:spring-amqp	eq	2.2.5.RELEASE
org.springframework.amqp:spring-amqp	eq	2.3.9
org.springframework.amqp:spring-amqp	eq	2.2.2.RELEASE
org.springframework.amqp:spring-amqp	eq	2.2.1.RELEASE
org.springframework.amqp:spring-amqp	eq	2.2.17.RELEASE
org.springframework.amqp:spring-amqp	eq	2.3.8
org.springframework.amqp:spring-amqp	eq	2.2.4.RELEASE
org.springframework.amqp:spring-amqp	eq	2.2.11.RELEASE