CVE-2023-34040
highpriority · track · 42EPSS 0.021 · 82 %ileexploit · PoCDEEURUUSEPSS · scored 2026-10-27
In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers. Specifically, an application is vulnerable when all of the following are true: * The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record * The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true. * The user allows untrusted sources to publish to a Kafka topic By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.3–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (4)
Public proof-of-concept and weaponised exploit code.
- huyennhat-dev/cve-2023-34040huyennhat-dev/cve-2023-34040PoC · poc_in_github
- pyn3rd/CVE-2023-34040Spring-Kafka-Deserialization-Remote-Code-ExecutionPoC · poc_in_github
affected products (10)
Products and version ranges known to be affected.
- vmware spring for apache kafka2.8.1 → 2.9.10nvdUScpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*
- vmware spring for apache kafka3.0.0 → 3.0.9nvdUScpe:2.3:a:vmware:spring_for_apache_kafka:*:*:*:*:*:*:*:*
- Maven org.springframework.kafka:spring-kafka2.8.1 → 2.9.11osvUSpkg:maven/org.springframework.kafka/spring-kafka
- Maven org.springframework.kafka:spring-kafka3.0.0 → 3.0.10osvUSpkg:maven/org.springframework.kafka/spring-kafka
advisories (2)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-2170VMware Tanzu Spring Framework for Apache Kafka: Schwachstelle ermöglicht nicht spezifizierten AngriffDeutsch2023-08-24csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in VMware Tanzu Spring Framework for Apache Kafka ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- GHSA-crqf-q9fp-hwjwSpring-Kafka has Java Deserialization vulnerability When Improperly Configured2023-08-24ghsa · osvUS
In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers. Specifically, an application is vulnerable when all of the following are true: * The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record * The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true. * The user allows untrusted sources to publish to a Kafka topic By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan