CVE-2026-41714
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Spring AMQP, applications configuring broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Risk Assessment
A man-in-the-middle attacker can intercept and modify communication with the RabbitMQ broker because missing certificate and hostname verification allows impersonation of the broker.
Recommendation
Always call setUseSSL(true) after configuring the URI with amqps:// protocol to ensure full TLS validation. Upgrading to the latest Spring AMQP version is also recommended.
Other vulnerabilities in Spring AMQP
See all- CVE-2016-2173Critical
Versions of Spring AMQP before 1.5.5 contain a vulnerability in the org.springframework.core.serializer.DefaultDeserializer class that allows remote attackers to execute arbitrary code.
- CVE-2026-59320Medium
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Affects Spring AMQP 4.1.0.
- CVE-2026-59272Medium
Applications shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, are exposed to man-in-the-middle interception of every log event. Affected Spring AMQP versions: 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-59275Medium
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Affected versions: Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-59271Medium
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Affected versions: Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-47860Medium
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Affects Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-41701Medium
Vulnerability in Spring AMQP causes correlation IDs for replies in RabbitTemplate.sendAndReceive() with fixed reply queue to be predictable due to an internal simple counter. Affects Spring AMQP versions 4.0.0-4.0.3, 3.2.0-3.2.10, 3.1.0-3.1.15, and 2.4.0-2.4.17.
Original NVD description (English source)
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.