CVE-2026-59272
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Applications shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, are exposed to man-in-the-middle interception of every log event. Affected Spring AMQP versions: 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
Risk Assessment
An attacker can intercept sensitive log data, potentially including credentials and business data, compromising confidentiality.
Recommendation
Update Spring AMQP to a patched version and ensure TLS connections are properly configured with certificate verification.
Other vulnerabilities in Spring AMQP
See all- CVE-2016-2173Critical
Versions of Spring AMQP before 1.5.5 contain a vulnerability in the org.springframework.core.serializer.DefaultDeserializer class that allows remote attackers to execute arbitrary code.
- CVE-2026-59320Medium
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Affects Spring AMQP 4.1.0.
- CVE-2026-59275Medium
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Affected versions: Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-59271Medium
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Affected versions: Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-47860Medium
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Affects Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-41714Medium
In Spring AMQP, applications configuring broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
- CVE-2026-41701Medium
Vulnerability in Spring AMQP causes correlation IDs for replies in RabbitTemplate.sendAndReceive() with fixed reply queue to be predictable due to an internal simple counter. Affects Spring AMQP versions 4.0.0-4.0.3, 3.2.0-3.2.10, 3.1.0-3.1.15, and 2.4.0-2.4.17.
Original NVD description (English source)
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Vulnerability data from NVD (NIST) · CISA KEV · EPSS