Search
Find a vulnerability
Search criteria
17 vulnerabilities found for Spring AMQP by Spring
CVE-2026-59320 (GCVE-0-2026-59320)
Vulnerability from nvd – Published: 2026-08-27 18:04 – Updated: 2026-08-28 22:46
VLAI
EPSS
VEX
Title
In Spring AMQP the link credit never replenished on listener exception path
Summary
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.
Spring AMQP 4.1.0
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 22:43 UTC
CWE
- CWE-772 Missing Release of Resource after Effective Lifetime
- CWE-772 - Missing Release of Resource after Effective Lifetime
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.1.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59320",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T22:43:09.232563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-772",
"description": "CWE-772 Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T22:46:54.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003c/p\u003e"
}
],
"value": "When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.\nSpring AMQP 4.1.0"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-772 Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T18:04:47.999Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59320"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "In Spring AMQP the link credit never replenished on listener exception path"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59320",
"datePublished": "2026-08-27T18:04:47.999Z",
"dateReserved": "2026-07-04T18:14:10.167Z",
"dateUpdated": "2026-08-28T22:46:54.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59272 (GCVE-0-2026-59272)
Vulnerability from nvd – Published: 2026-08-27 16:41 – Updated: 2026-08-28 03:55
VLAI
EPSS
VEX
Title
Log4j2 AmqpAppender disables TLS hostname verification by default
Summary
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 00:00 UTC
CWE
- CWE-297 Improper Validation of Certificate with Host Mismatch
- CWE-297 - Improper Validation of Certificate with Host Mismatch
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.1.0
(custom)
Affected: 4.0.0 , ≤ 4.0.4 (custom) Affected: 3.2.0 , ≤ 3.2.12 (custom) Affected: 0 , ≤ 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59272",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T03:55:35.123Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.2.12",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAny application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
}
],
"value": "Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T16:41:08.650Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59272"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Log4j2 AmqpAppender disables TLS hostname verification by default"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59272",
"datePublished": "2026-08-27T16:41:08.650Z",
"dateReserved": "2026-07-04T18:13:09.972Z",
"dateUpdated": "2026-08-28T03:55:35.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59275 (GCVE-0-2026-59275)
Vulnerability from nvd – Published: 2026-08-27 05:20 – Updated: 2026-08-28 03:55
VLAI
EPSS
VEX
Title
Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)
Summary
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 00:00 UTC
CWE
- CWE-502 Deserialization of Untrusted Data
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.1.0
(custom)
Affected: 4.0.0 , ≤ 4.0.4 (custom) Affected: 3.2.0 , ≤ 3.2.12 (custom) Affected: 0 , ≤ 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59275",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T03:55:28.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.2.12",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
}
],
"value": "A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:21:43.569Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59275"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59275",
"datePublished": "2026-08-27T05:20:36.022Z",
"dateReserved": "2026-07-04T18:13:09.972Z",
"dateUpdated": "2026-08-28T03:55:28.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59271 (GCVE-0-2026-59271)
Vulnerability from nvd – Published: 2026-08-27 05:20 – Updated: 2026-08-27 14:15
VLAI
EPSS
VEX
Title
Admin password disclosed in BrokerNotAliveException message
Summary
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:15 UTC
CWE
- CWE-209 Generation of Error Message Containing Sensitive Information
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.1.0
(custom)
Affected: 4.0.0 , ≤ 4.0.4 (custom) Affected: 3.2.0 , ≤ 3.2.12 (custom) Affected: 0 , ≤ 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59271",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:15:12.907398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:15:39.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.2.12",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
}
],
"value": "When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:21:42.676Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59271"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Admin password disclosed in BrokerNotAliveException message"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59271",
"datePublished": "2026-08-27T05:20:34.133Z",
"dateReserved": "2026-07-04T18:13:09.972Z",
"dateUpdated": "2026-08-27T14:15:39.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47860 (GCVE-0-2026-47860)
Vulnerability from nvd – Published: 2026-08-26 23:28 – Updated: 2026-08-27 14:48
VLAI
EPSS
VEX
Title
Unbounded decompression of attacker-supplied compressed message bodies
Summary
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:47 UTC
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.1.0
(custom)
Affected: 4.0.0 , ≤ 4.0.4 (custom) Affected: 3.2.0 , ≤ 3.2.12 (custom) Affected: 0 , ≤ 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:47:40.938402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:48:04.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.2.12",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
}
],
"value": "An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification, Decompression Bomb)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T23:28:46.607Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47860"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unbounded decompression of attacker-supplied compressed message bodies"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47860",
"datePublished": "2026-08-26T23:28:46.607Z",
"dateReserved": "2026-05-20T10:00:55.156Z",
"dateUpdated": "2026-08-27T14:48:04.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41714 (GCVE-0-2026-41714)
Vulnerability from nvd – Published: 2026-06-09 23:48 – Updated: 2026-06-27 21:14
VLAI
EPSS
VEX
Title
In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager
Summary
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 13:01 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.0.0 , < 4.0.3.1
(custom)
Affected: 3.2.0 , < 3.2.10.1 (custom) Affected: 3.1.0 , < 3.1.16 (custom) Affected: 2.4.0 , < 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T13:01:58.139774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T13:02:07.351Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"lessThan": "4.0.3.1",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "3.2.10.1",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.1.16",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "2.4.18",
"status": "affected",
"version": "2.4.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri(\"amqps://...\") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
}
],
"value": "Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri(\"amqps://...\") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Applications that configure AMQP broker connections via setUri(\"amqps://...\") without calling setUseSSL(true) receive TLS encryption with no certificate validation or hostname verification."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T21:14:02.581Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-41714"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "In Spring AMQP the RabbitConnectionFactoryBean.setUri(\"amqps://...\") bypasses secure SSL setup, uses TrustEverythingTrustManager",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41714",
"datePublished": "2026-06-09T23:48:16.317Z",
"dateReserved": "2026-04-22T06:21:37.020Z",
"dateUpdated": "2026-06-27T21:14:02.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41701 (GCVE-0-2026-41701)
Vulnerability from nvd – Published: 2026-06-09 23:47 – Updated: 2026-06-23 20:48
VLAI
EPSS
VEX
Title
In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Summary
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 13:04 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.0.0 , < 4.0.3.1
(custom)
Affected: 3.2.0 , < 3.2.10.1 (custom) Affected: 3.1.0 , < 3.1.16 (custom) Affected: 2.4.0 , < 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41701",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T13:04:42.963494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T13:04:52.283Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"lessThan": "4.0.3.1",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "3.2.10.1",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.1.16",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "2.4.18",
"status": "affected",
"version": "2.4.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
}
],
"value": "Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker who can inject messages into a fixed reply queue can predict sequential correlation IDs and poison replies, resulting in integrity or confidentiality impacts."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330: Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T20:48:22.061Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-41701"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41701",
"datePublished": "2026-06-09T23:47:54.996Z",
"dateReserved": "2026-04-22T06:21:22.982Z",
"dateUpdated": "2026-06-23T20:48:22.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-34050 (GCVE-0-2023-34050)
Vulnerability from nvd – Published: 2023-10-19 07:11 – Updated: 2024-09-12 17:58
VLAI
EPSS
VEX
Title
Spring AMQP Deserialization Vulnerability
Summary
In spring AMQP versions 1.0.0 to
2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class
names were added to Spring AMQP, allowing users to lock down deserialization of
data in messages from untrusted sources; however by default, when no allowed
list was provided, all classes could be deserialized.
Specifically, an application is
vulnerable if
* the
SimpleMessageConverter or SerializerMessageConverter is used
* the user
does not configure allowed list patterns
* untrusted
message originators gain permissions to write messages to the RabbitMQ
broker to send malicious content
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-12 17:58 UTC
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
1.0.0 , < 2.4.17
(2.4.17)
Affected: 3.0.0 , < 3.0.10 (3.0.10) |
Date Public
2023-10-18 06:52
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:01:52.410Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://spring.io/security/cve-2023-34050"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-34050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T17:58:30.805271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T17:58:46.718Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"MacOS",
"Linux",
"iOS",
"Android",
"x86",
"ARM",
"64 bit",
"Windows",
"32 bit"
],
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"lessThan": "2.4.17",
"status": "affected",
"version": "1.0.0",
"versionType": "2.4.17"
},
{
"lessThan": "3.0.10",
"status": "affected",
"version": "3.0.0",
"versionType": "3.0.10"
}
]
}
],
"datePublic": "2023-10-18T06:52:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\n\n\n\n\n\n\n\u003cp\u003eIn spring AMQP versions 1.0.0 to\n2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class\nnames were added to Spring AMQP, allowing users to lock down deserialization of\ndata in messages from untrusted sources; however by default, when no allowed\nlist was provided, all classes could be deserialized.\u003c/p\u003e\n\n\u003cp\u003eSpecifically, an application is\nvulnerable if\u003c/p\u003e\n\n\u003cul\u003e\n \u003cli\u003ethe\n SimpleMessageConverter or SerializerMessageConverter is used\u003c/li\u003e\n \u003cli\u003ethe user\n does not configure allowed list patterns\u003c/li\u003e\n \u003cli\u003euntrusted\n message originators gain permissions to write messages to the RabbitMQ\n broker to send malicious content\u003c/li\u003e\n\u003c/ul\u003e\n\n\n\n\n\n"
}
],
"value": "\n\n\n\n\n\n\n\n\n\nIn spring AMQP versions 1.0.0 to\n2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class\nnames were added to Spring AMQP, allowing users to lock down deserialization of\ndata in messages from untrusted sources; however by default, when no allowed\nlist was provided, all classes could be deserialized.\n\n\n\nSpecifically, an application is\nvulnerable if\n\n\n\n\n * the\n SimpleMessageConverter or SerializerMessageConverter is used\n\n * the user\n does not configure allowed list patterns\n\n * untrusted\n message originators gain permissions to write messages to the RabbitMQ\n broker to send malicious content\n\n\n\n\n\n\n\n\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-19T07:11:35.038Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2023-34050"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spring AMQP Deserialization Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2023-34050",
"datePublished": "2023-10-19T07:11:35.038Z",
"dateReserved": "2023-05-25T17:21:56.203Z",
"dateUpdated": "2024-09-12T17:58:46.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-59320 (GCVE-0-2026-59320)
Vulnerability from cvelistv5 – Published: 2026-08-27 18:04 – Updated: 2026-08-28 22:46
VLAI
EPSS
VEX
Title
In Spring AMQP the link credit never replenished on listener exception path
Summary
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.
Spring AMQP 4.1.0
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 22:43 UTC
CWE
- CWE-772 Missing Release of Resource after Effective Lifetime
- CWE-772 - Missing Release of Resource after Effective Lifetime
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.1.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59320",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T22:43:09.232563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-772",
"description": "CWE-772 Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T22:46:54.662Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003c/p\u003e"
}
],
"value": "When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.\nSpring AMQP 4.1.0"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-772 Missing Release of Resource after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T18:04:47.999Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59320"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "In Spring AMQP the link credit never replenished on listener exception path"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59320",
"datePublished": "2026-08-27T18:04:47.999Z",
"dateReserved": "2026-07-04T18:14:10.167Z",
"dateUpdated": "2026-08-28T22:46:54.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59272 (GCVE-0-2026-59272)
Vulnerability from cvelistv5 – Published: 2026-08-27 16:41 – Updated: 2026-08-28 03:55
VLAI
EPSS
VEX
Title
Log4j2 AmqpAppender disables TLS hostname verification by default
Summary
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 00:00 UTC
CWE
- CWE-297 Improper Validation of Certificate with Host Mismatch
- CWE-297 - Improper Validation of Certificate with Host Mismatch
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.1.0
(custom)
Affected: 4.0.0 , ≤ 4.0.4 (custom) Affected: 3.2.0 , ≤ 3.2.12 (custom) Affected: 0 , ≤ 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59272",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T03:55:35.123Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.2.12",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAny application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
}
],
"value": "Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T16:41:08.650Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59272"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Log4j2 AmqpAppender disables TLS hostname verification by default"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59272",
"datePublished": "2026-08-27T16:41:08.650Z",
"dateReserved": "2026-07-04T18:13:09.972Z",
"dateUpdated": "2026-08-28T03:55:35.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59275 (GCVE-0-2026-59275)
Vulnerability from cvelistv5 – Published: 2026-08-27 05:20 – Updated: 2026-08-28 03:55
VLAI
EPSS
VEX
Title
Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)
Summary
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 00:00 UTC
CWE
- CWE-502 Deserialization of Untrusted Data
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.1.0
(custom)
Affected: 4.0.0 , ≤ 4.0.4 (custom) Affected: 3.2.0 , ≤ 3.2.12 (custom) Affected: 0 , ≤ 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59275",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T03:55:28.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.2.12",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
}
],
"value": "A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:21:43.569Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59275"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59275",
"datePublished": "2026-08-27T05:20:36.022Z",
"dateReserved": "2026-07-04T18:13:09.972Z",
"dateUpdated": "2026-08-28T03:55:28.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59271 (GCVE-0-2026-59271)
Vulnerability from cvelistv5 – Published: 2026-08-27 05:20 – Updated: 2026-08-27 14:15
VLAI
EPSS
VEX
Title
Admin password disclosed in BrokerNotAliveException message
Summary
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:15 UTC
CWE
- CWE-209 Generation of Error Message Containing Sensitive Information
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.1.0
(custom)
Affected: 4.0.0 , ≤ 4.0.4 (custom) Affected: 3.2.0 , ≤ 3.2.12 (custom) Affected: 0 , ≤ 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59271",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:15:12.907398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:15:39.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.2.12",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
}
],
"value": "When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-209 Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:21:42.676Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59271"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Admin password disclosed in BrokerNotAliveException message"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59271",
"datePublished": "2026-08-27T05:20:34.133Z",
"dateReserved": "2026-07-04T18:13:09.972Z",
"dateUpdated": "2026-08-27T14:15:39.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47860 (GCVE-0-2026-47860)
Vulnerability from cvelistv5 – Published: 2026-08-26 23:28 – Updated: 2026-08-27 14:48
VLAI
EPSS
VEX
Title
Unbounded decompression of attacker-supplied compressed message bodies
Summary
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:47 UTC
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.1.0
(custom)
Affected: 4.0.0 , ≤ 4.0.4 (custom) Affected: 3.2.0 , ≤ 3.2.12 (custom) Affected: 0 , ≤ 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:47:40.938402Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:48:04.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.0.4",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.2.12",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2.4.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
}
],
"value": "An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification, Decompression Bomb)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T23:28:46.607Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47860"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unbounded decompression of attacker-supplied compressed message bodies"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47860",
"datePublished": "2026-08-26T23:28:46.607Z",
"dateReserved": "2026-05-20T10:00:55.156Z",
"dateUpdated": "2026-08-27T14:48:04.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41714 (GCVE-0-2026-41714)
Vulnerability from cvelistv5 – Published: 2026-06-09 23:48 – Updated: 2026-06-27 21:14
VLAI
EPSS
VEX
Title
In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager
Summary
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 13:01 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.0.0 , < 4.0.3.1
(custom)
Affected: 3.2.0 , < 3.2.10.1 (custom) Affected: 3.1.0 , < 3.1.16 (custom) Affected: 2.4.0 , < 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T13:01:58.139774Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T13:02:07.351Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"lessThan": "4.0.3.1",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "3.2.10.1",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.1.16",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "2.4.18",
"status": "affected",
"version": "2.4.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri(\"amqps://...\") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
}
],
"value": "Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri(\"amqps://...\") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Applications that configure AMQP broker connections via setUri(\"amqps://...\") without calling setUseSSL(true) receive TLS encryption with no certificate validation or hostname verification."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-27T21:14:02.581Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-41714"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "In Spring AMQP the RabbitConnectionFactoryBean.setUri(\"amqps://...\") bypasses secure SSL setup, uses TrustEverythingTrustManager",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41714",
"datePublished": "2026-06-09T23:48:16.317Z",
"dateReserved": "2026-04-22T06:21:37.020Z",
"dateUpdated": "2026-06-27T21:14:02.581Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41701 (GCVE-0-2026-41701)
Vulnerability from cvelistv5 – Published: 2026-06-09 23:47 – Updated: 2026-06-23 20:48
VLAI
EPSS
VEX
Title
In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Summary
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 13:04 UTC
CWE
- CWE-330 - Use of Insufficiently Random Values
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
4.0.0 , < 4.0.3.1
(custom)
Affected: 3.2.0 , < 3.2.10.1 (custom) Affected: 3.1.0 , < 3.1.16 (custom) Affected: 2.4.0 , < 2.4.18 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41701",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-10T13:04:42.963494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-10T13:04:52.283Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"lessThan": "4.0.3.1",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "3.2.10.1",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.1.16",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "2.4.18",
"status": "affected",
"version": "2.4.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
}
],
"value": "Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker who can inject messages into a fixed reply queue can predict sequential correlation IDs and poison replies, resulting in integrity or confidentiality impacts."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-330",
"description": "CWE-330: Use of Insufficiently Random Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T20:48:22.061Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-41701"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-41701",
"datePublished": "2026-06-09T23:47:54.996Z",
"dateReserved": "2026-04-22T06:21:22.982Z",
"dateUpdated": "2026-06-23T20:48:22.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-34050 (GCVE-0-2023-34050)
Vulnerability from cvelistv5 – Published: 2023-10-19 07:11 – Updated: 2024-09-12 17:58
VLAI
EPSS
VEX
Title
Spring AMQP Deserialization Vulnerability
Summary
In spring AMQP versions 1.0.0 to
2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class
names were added to Spring AMQP, allowing users to lock down deserialization of
data in messages from untrusted sources; however by default, when no allowed
list was provided, all classes could be deserialized.
Specifically, an application is
vulnerable if
* the
SimpleMessageConverter or SerializerMessageConverter is used
* the user
does not configure allowed list patterns
* untrusted
message originators gain permissions to write messages to the RabbitMQ
broker to send malicious content
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-12 17:58 UTC
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring AMQP |
Affected:
1.0.0 , < 2.4.17
(2.4.17)
Affected: 3.0.0 , < 3.0.10 (3.0.10) |
Date Public
2023-10-18 06:52
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:01:52.410Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://spring.io/security/cve-2023-34050"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-34050",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-12T17:58:30.805271Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-12T17:58:46.718Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"MacOS",
"Linux",
"iOS",
"Android",
"x86",
"ARM",
"64 bit",
"Windows",
"32 bit"
],
"product": "Spring AMQP",
"vendor": "Spring",
"versions": [
{
"lessThan": "2.4.17",
"status": "affected",
"version": "1.0.0",
"versionType": "2.4.17"
},
{
"lessThan": "3.0.10",
"status": "affected",
"version": "3.0.0",
"versionType": "3.0.10"
}
]
}
],
"datePublic": "2023-10-18T06:52:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\n\n\n\n\n\n\n\u003cp\u003eIn spring AMQP versions 1.0.0 to\n2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class\nnames were added to Spring AMQP, allowing users to lock down deserialization of\ndata in messages from untrusted sources; however by default, when no allowed\nlist was provided, all classes could be deserialized.\u003c/p\u003e\n\n\u003cp\u003eSpecifically, an application is\nvulnerable if\u003c/p\u003e\n\n\u003cul\u003e\n \u003cli\u003ethe\n SimpleMessageConverter or SerializerMessageConverter is used\u003c/li\u003e\n \u003cli\u003ethe user\n does not configure allowed list patterns\u003c/li\u003e\n \u003cli\u003euntrusted\n message originators gain permissions to write messages to the RabbitMQ\n broker to send malicious content\u003c/li\u003e\n\u003c/ul\u003e\n\n\n\n\n\n"
}
],
"value": "\n\n\n\n\n\n\n\n\n\nIn spring AMQP versions 1.0.0 to\n2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class\nnames were added to Spring AMQP, allowing users to lock down deserialization of\ndata in messages from untrusted sources; however by default, when no allowed\nlist was provided, all classes could be deserialized.\n\n\n\nSpecifically, an application is\nvulnerable if\n\n\n\n\n * the\n SimpleMessageConverter or SerializerMessageConverter is used\n\n * the user\n does not configure allowed list patterns\n\n * untrusted\n message originators gain permissions to write messages to the RabbitMQ\n broker to send malicious content\n\n\n\n\n\n\n\n\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-19T07:11:35.038Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2023-34050"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spring AMQP Deserialization Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2023-34050",
"datePublished": "2023-10-19T07:11:35.038Z",
"dateReserved": "2023-05-25T17:21:56.203Z",
"dateUpdated": "2024-09-12T17:58:46.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CERTFR-2026-AVI-0719
Vulnerability from certfr_avis - Published: 2026-06-10 - Updated: 2026-06-10
De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un contournement de la politique de sécurité et un déni de service.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Spring | Spring Data KeyValue | Data KeyValue versions 3.3.x antérieures à 3.3.17 | ||
| Spring | Data REST | Data REST versions 4.3.x antérieures à 4.3.17 | ||
| Spring | Spring Data KeyValue | Data KeyValue versions 3.4.x antérieures à 3.4.15 | ||
| Spring | Spring Data Commons | Data Commons (affecte tous les modules Data store de manière transitive) versions 3.5.x antérieures à 3.5.12 | ||
| Spring | Spring Data Relational | Data Relational versions 3.4.x antérieures à 3.4.15 | ||
| Spring | Spring AMQP | AMQP versions 4.0.x antérieures à 4.0.4 | ||
| Spring | Spring Data Commons | Data Commons (affecte tous les modules Data store de manière transitive) versions 4.0.x antérieures à 4.0.6 | ||
| Spring | Spring Data MongoDB | Data MongoDB versions 3.4.x antérieures à 3.4.20 | ||
| Spring | Spring AMQP | AMQP versions antérieures à 4.0.3.1 | ||
| Spring | Spring AMQP | AMQP versions antérieures à 3.2.10.1 | ||
| Spring | Spring Data Relational | Data Relational versions 3.3.x antérieures à 3.3.17 | ||
| Spring | Spring Data Relational | Data Relational versions 4.0.x antérieures à 4.0.6 | ||
| Spring | Spring Data Commons | Data Commons (affecte tous les modules Data store de manière transitive) versions 3.3.x antérieures à 3.3.17 | ||
| Spring | Spring Data KeyValue | Data KeyValue versions 3.5.x antérieures à 3.5.12 | ||
| Spring | Spring AMQP | AMQP versions 2.4.x antérieures à 2.4.18 | ||
| Spring | Spring Security | Security versions 7.0.x antérieures à 7.0.6 | ||
| Spring | Spring Data Commons | Data Commons (affecte tous les modules Data store de manière transitive) versions 2.7.x antérieures à 2.7.20 | ||
| Spring | Spring Data MongoDB | Data MongoDB versions 4.3.x antérieures à 4.3.17 | ||
| Spring | Spring Security | Security versions 1.5.x antérieures à 1.5.8 | ||
| Spring | Spring Security | Security versions 6.3.x antérieures à 6.3.17 | ||
| Spring | Spring Data MongoDB | Data MongoDB versions 4.5.x antérieures à 4.5.12 | ||
| Spring | Data REST | Data REST versions 3.7.x antérieures à 3.7.20 | ||
| Spring | Data REST | Data REST versions 4.5.x antérieures à 4.5.12 | ||
| Spring | Data REST | Data REST versions 5.0.x antérieures à 5.0.6 | ||
| Spring | Spring Data Relational | Data Relational versions 3.5.x antérieures à 3.5.12 | ||
| Spring | Spring AMQP | AMQP versions 3.1.x antérieures à 3.1.16 | ||
| Spring | Spring Data Relational | Data Relational versions 2.4.x antérieures à 2.4.20 | ||
| Spring | Data REST | Data REST versions 4.4.x antérieures à 4.4.15 | ||
| Spring | Spring Security | Security versions 5.7.x antérieures à 5.7.24 | ||
| Spring | Spring Data KeyValue | Data KeyValue versions 4.0.x antérieures à 4.0.6 | ||
| Spring | Spring Data MongoDB | Data MongoDB versions 4.4.x antérieures à 4.4.15 | ||
| Spring | Spring Data KeyValue | Data KeyValue versions 2.7.x antérieures à 2.7.20 | ||
| Spring | Spring Security | Security versions 6.5.x antérieures à 6.5.11 | ||
| Spring | Spring Data MongoDB | Data MongoDB versions 5.0.x antérieures à 5.0.6 | ||
| Spring | Spring AMQP | AMQP versions 3.2.x antérieures à 3.2.11 | ||
| Spring | Spring Security | Security versions 6.4.x antérieures à 6.4.17 | ||
| Spring | Spring Data Commons | Data Commons (affecte tous les modules Data store de manière transitive) versions 3.4.x antérieures à 3.4.15 | ||
| Spring | Spring Security | Security versions 5.8.x antérieures à 5.8.26 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Data KeyValue versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
"product": {
"name": "Spring Data KeyValue",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data REST versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
"product": {
"name": "Data REST",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data KeyValue versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
"product": {
"name": "Spring Data KeyValue",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
"product": {
"name": "Spring Data Commons",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data Relational versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
"product": {
"name": "Spring Data Relational",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "AMQP versions 4.0.x ant\u00e9rieures \u00e0 4.0.4",
"product": {
"name": "Spring AMQP",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
"product": {
"name": "Spring Data Commons",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data MongoDB versions 3.4.x ant\u00e9rieures \u00e0 3.4.20",
"product": {
"name": "Spring Data MongoDB",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "AMQP versions ant\u00e9rieures \u00e0 4.0.3.1",
"product": {
"name": "Spring AMQP",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "AMQP versions ant\u00e9rieures \u00e0 3.2.10.1",
"product": {
"name": "Spring AMQP",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data Relational versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
"product": {
"name": "Spring Data Relational",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data Relational versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
"product": {
"name": "Spring Data Relational",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
"product": {
"name": "Spring Data Commons",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data KeyValue versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
"product": {
"name": "Spring Data KeyValue",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "AMQP versions 2.4.x ant\u00e9rieures \u00e0 2.4.18",
"product": {
"name": "Spring AMQP",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Security versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
"product": {
"name": "Spring Security",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
"product": {
"name": "Spring Data Commons",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data MongoDB versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
"product": {
"name": "Spring Data MongoDB",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Security versions 1.5.x ant\u00e9rieures \u00e0 1.5.8",
"product": {
"name": "Spring Security",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Security versions 6.3.x ant\u00e9rieures \u00e0 6.3.17",
"product": {
"name": "Spring Security",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data MongoDB versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
"product": {
"name": "Spring Data MongoDB",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data REST versions 3.7.x ant\u00e9rieures \u00e0 3.7.20",
"product": {
"name": "Data REST",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data REST versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
"product": {
"name": "Data REST",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data REST versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
"product": {
"name": "Data REST",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data Relational versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
"product": {
"name": "Spring Data Relational",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "AMQP versions 3.1.x ant\u00e9rieures \u00e0 3.1.16",
"product": {
"name": "Spring AMQP",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data Relational versions 2.4.x ant\u00e9rieures \u00e0 2.4.20",
"product": {
"name": "Spring Data Relational",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data REST versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
"product": {
"name": "Data REST",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Security versions 5.7.x ant\u00e9rieures \u00e0 5.7.24",
"product": {
"name": "Spring Security",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data KeyValue versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
"product": {
"name": "Spring Data KeyValue",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data MongoDB versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
"product": {
"name": "Spring Data MongoDB",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data KeyValue versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
"product": {
"name": "Spring Data KeyValue",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Security versions 6.5.x ant\u00e9rieures \u00e0 6.5.11",
"product": {
"name": "Spring Security",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data MongoDB versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
"product": {
"name": "Spring Data MongoDB",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "AMQP versions 3.2.x ant\u00e9rieures \u00e0 3.2.11",
"product": {
"name": "Spring AMQP",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Security versions 6.4.x ant\u00e9rieures \u00e0 6.4.17",
"product": {
"name": "Spring Security",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
"product": {
"name": "Spring Data Commons",
"vendor": {
"name": "Spring",
"scada": false
}
}
},
{
"description": "Security versions 5.8.x ant\u00e9rieures \u00e0 5.8.26",
"product": {
"name": "Spring Security",
"vendor": {
"name": "Spring",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-41716",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41716"
},
{
"name": "CVE-2026-40993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40993"
},
{
"name": "CVE-2026-41717",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41717"
},
{
"name": "CVE-2026-41721",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41721"
},
{
"name": "CVE-2026-41695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41695"
},
{
"name": "CVE-2026-41729",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41729"
},
{
"name": "CVE-2026-41719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41719"
},
{
"name": "CVE-2026-41697",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41697"
},
{
"name": "CVE-2026-41008",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41008"
},
{
"name": "CVE-2026-41694",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41694"
},
{
"name": "CVE-2026-41696",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41696"
},
{
"name": "CVE-2026-41711",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41711"
},
{
"name": "CVE-2026-40988",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40988"
},
{
"name": "CVE-2026-41003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41003"
},
{
"name": "CVE-2026-41701",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41701"
}
],
"initial_release_date": "2026-06-10T00:00:00",
"last_revision_date": "2026-06-10T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0719",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-06-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, un contournement de la politique de s\u00e9curit\u00e9 et un d\u00e9ni de service.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
"vendor_advisories": [
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41003",
"url": "https://spring.io/security/cve-2026-41003"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41696",
"url": "https://spring.io/security/cve-2026-41696"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41697",
"url": "https://spring.io/security/cve-2026-41697"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41716",
"url": "https://spring.io/security/cve-2026-41716"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41721",
"url": "https://spring.io/security/cve-2026-41721"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41695",
"url": "https://spring.io/security/cve-2026-41695"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41694",
"url": "https://spring.io/security/cve-2026-41694"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41711",
"url": "https://spring.io/security/cve-2026-41711"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41008",
"url": "https://spring.io/security/cve-2026-41008"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41729",
"url": "https://spring.io/security/cve-2026-41729"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41701",
"url": "https://spring.io/security/cve-2026-41701"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40993",
"url": "https://spring.io/security/cve-2026-40993"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41719",
"url": "https://spring.io/security/cve-2026-41719"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40988",
"url": "https://spring.io/security/cve-2026-40988"
},
{
"published_at": "2026-06-09",
"title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41717",
"url": "https://spring.io/security/cve-2026-41717"
}
]
}