CVE-2021-22095: VMware Spring Advanced Message Queuing Protocol

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message

Affected products

• VMware Spring Advanced Message Queuing Protocol: from 2.2.0, before 2.2.19 (fixed in 2.2.19); from 2.3.0, before 2.3.11 (fixed in 2.3.11)

Published 2021-11-30. Last modified 2026-06-17.