CVE-2023-34040 is a high-severity insecure deserialization vulnerability in org.springframework.kafka:spring-kafka (maven), affecting versions >= 3.0.0, < 3.0.10. It is fixed in 3.0.10, 2.9.11.
In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers. Specifically, an application is vulnerable when all of the following are true: The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true. The user allows untrusted sources to publish to a Kafka topic By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.
Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect. Typical impact: arbitrary code execution or logic abuse.
CVE-2023-34040 has a CVSS score of 7.8 (High). The vector is requires local access, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (3.0.10, 2.9.11). Upgrading removes the vulnerable code path.
maven
org.springframework.kafka:spring-kafka (>= 3.0.0, < 3.0.10)org.springframework.kafka:spring-kafka (>= 2.8.1, < 2.9.11)org.springframework.kafka:spring-kafka → 3.0.10 (maven)org.springframework.kafka:spring-kafka → 2.9.11 (maven)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's Application Detection and Response identifies whether CVE-2023-34040 is reachable in your applications. Explore runtime application protection for your team.
See if CVE-2023-34040 is reachable in your applications. Get a demo
Upgrade the following packages to resolve this vulnerability:
org.springframework.kafka:spring-kafka to 3.0.10 or laterorg.springframework.kafka:spring-kafka to 2.9.11 or laterKodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2023-34040 is a high-severity insecure deserialization vulnerability in org.springframework.kafka:spring-kafka (maven), affecting versions >= 3.0.0, < 3.0.10. It is fixed in 3.0.10, 2.9.11. Untrusted serialized data is processed by a deserializer that can instantiate arbitrary objects or execute code as a side effect.
CVE-2023-34040 has a CVSS score of 7.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
org.springframework.kafka:spring-kafka (maven) versions >= 3.0.0, < 3.0.10 is affected.
Yes. CVE-2023-34040 is fixed in 3.0.10, 2.9.11. Upgrade to this version or later.
Whether CVE-2023-34040 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
org.springframework.kafka:spring-kafka to 3.0.10 or laterorg.springframework.kafka:spring-kafka to 2.9.11 or later