{"action":"Upgrade org.springframework.kafka:spring-kafka to 2.9.11 (2.x) or 3.0.10 (3.x) or later.","affected":[{"fixed":"2.9.11","introduced":"2.8.1"},{"fixed":"3.0.10","introduced":"3.0.0"}],"component":"org.springframework.kafka:spring-kafka","cve_ids":["CVE-2023-34040"],"ecosystem":"Maven","epss":0.0209,"exploited":false,"fixed_versions":["2.9.11","3.0.10"],"ghsa_id":"GHSA-crqf-q9fp-hwjw","id":"tcs_01M5N8T8D418KKMTV738AG8328","modified_at":"2024-11-05T18:06:43.452610Z","published_at":"2023-08-24T15:31:10Z","references":["https://osv.dev/vulnerability/GHSA-crqf-q9fp-hwjw","https://nvd.nist.gov/vuln/detail/CVE-2023-34040","https://github.com/spring-projects/spring-kafka/commit/25ac793a78725e2ca4a3a2888a1506a4bfcf0c9d","https://github.com/spring-projects/spring-kafka/commit/eb779679812f61a8553ced3d0e4069dca65560ed","https://github.com/spring-projects/spring-kafka","https://spring.io/security/cve-2023-34040"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"GHSA-crqf-q9fp-hwjw","url":"https://osv.dev/vulnerability/GHSA-crqf-q9fp-hwjw"}],"summary":"Spring-Kafka has Java Deserialization vulnerability When Improperly Configured"}