References https://spring.io/security/cve-2023-34040 https://nvd.nist.gov/vuln/detail/CVE-2023-34040 https://github.com/advisories/GHSA-crqf-q9fp-hwjw https://springframework.org.cn/security/cve-2023-34040 https://cn-sec.com/archives/3778379.html https://zhuanlan.zhihu.com/p/664928159 https://juejin.cn/post/7271056651129897018 https://www.sohu.com/a/714843166_121362256 https://medium.com/@0xd3vil/spring-kafka-deserialization-vulnerability-cve-2023-34040-analysis-f968de7c869e https://chinese.opswat.com/blog/safeguarding-against-deserialization-attacks-in-spring-for-apache-kafka https://access.redhat.com/security/cve/CVE-2023-34040 https://tuxcare.com/cve-tracker/cve/details/cve-2023-34040/
Related VulnerabilitiesPoCCVE-2026-5562: Provectus kafka-ui <=0.7.2 - Remote Code ExecutionApache Kafka UI /smartfilters/testexecutions 代码执行漏洞(CVE-2026-5562)SpringBlade /api/blade-log/api/list SQL 注入漏洞SpringBlade /api/blade-user/list SQL 注入漏洞Spring Actuator 未授权访问漏洞PoCspringboot-sbom: Spring Boot Actuator SBOM - ExposurePoCCVE-2025-41242: Spring Framework - Path TraversalPoCspringboot-httpexchanges: Detects Springboot HTTP Exchanges ActuatorApache Kafka 认证绕过漏洞(CVE-2026-33557)PoCCVE-2024-38819: Spring Framework Path Traversal in Functional Web FrameworksPentaho /pentaho/j_spring_security_check 默认口令漏洞PoCCVE-2026-22739: Spring Cloud Config Server - Path TraversalPoCCVE-2025-27817: Apache Kafka Client - Arbitrary File Read