CVE-2026-40971

MediumCVSS 5.0

Published: 27/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected versions: Spring Boot 4.0.0–4.0.5 (fixed in 4.0.6), 3.5.0–3.5.13 (fixed in 3.5.14).

Risk Assessment

Lack of hostname verification enables man-in-the-middle attacks, potentially leading to interception or modification of communication with the RabbitMQ broker.

Recommendation

Update Spring Boot to version 4.0.6 or 3.5.14 (depending on the branch), which include hostname verification fixes.

Original NVD description (English source)

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.