Search

Find a vulnerability

Search criteria

    17 vulnerabilities found for Spring AMQP by Spring

    CVE-2026-59320 (GCVE-0-2026-59320)

    Vulnerability from nvd – Published: 2026-08-27 18:04 – Updated: 2026-08-28 22:46
    VLAI
    Title
    In Spring AMQP the link credit never replenished on listener exception path
    Summary
    When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-28 22:43 UTC
    CWE
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.1.0 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59320",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-28T22:43:09.232563Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-772",
                    "description": "CWE-772 Missing Release of Resource after Effective Lifetime",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-28T22:46:54.662Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eWhen a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003c/p\u003e"
                }
              ],
              "value": "When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.\nSpring AMQP 4.1.0"
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-772 Missing Release of Resource after Effective Lifetime",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-27T18:04:47.999Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-59320"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "In Spring AMQP the link credit never replenished on listener exception path"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-59320",
        "datePublished": "2026-08-27T18:04:47.999Z",
        "dateReserved": "2026-07-04T18:14:10.167Z",
        "dateUpdated": "2026-08-28T22:46:54.662Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-59272 (GCVE-0-2026-59272)

    Vulnerability from nvd – Published: 2026-08-27 16:41 – Updated: 2026-08-28 03:55
    VLAI
    Title
    Log4j2 AmqpAppender disables TLS hostname verification by default
    Summary
    Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-27 00:00 UTC
    CWE
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.1.0 (custom)
    Affected: 4.0.0 , ≤ 4.0.4 (custom)
    Affected: 3.2.0 , ≤ 3.2.12 (custom)
    Affected: 0 , ≤ 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59272",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-27T00:00:00+00:00",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-297",
                    "description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-28T03:55:35.123Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.0.4",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "3.2.12",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "2.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAny application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
                }
              ],
              "value": "Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-27T16:41:08.650Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-59272"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Log4j2 AmqpAppender disables TLS hostname verification by default"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-59272",
        "datePublished": "2026-08-27T16:41:08.650Z",
        "dateReserved": "2026-07-04T18:13:09.972Z",
        "dateUpdated": "2026-08-28T03:55:35.123Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-59275 (GCVE-0-2026-59275)

    Vulnerability from nvd – Published: 2026-08-27 05:20 – Updated: 2026-08-28 03:55
    VLAI
    Title
    Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)
    Summary
    A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-27 00:00 UTC
    CWE
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.1.0 (custom)
    Affected: 4.0.0 , ≤ 4.0.4 (custom)
    Affected: 3.2.0 , ≤ 3.2.12 (custom)
    Affected: 0 , ≤ 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59275",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-27T00:00:00+00:00",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-502",
                    "description": "CWE-502 Deserialization of Untrusted Data",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-28T03:55:28.836Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.0.4",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "3.2.12",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "2.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
                }
              ],
              "value": "A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-502 Deserialization of Untrusted Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-27T05:21:43.569Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-59275"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-59275",
        "datePublished": "2026-08-27T05:20:36.022Z",
        "dateReserved": "2026-07-04T18:13:09.972Z",
        "dateUpdated": "2026-08-28T03:55:28.836Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-59271 (GCVE-0-2026-59271)

    Vulnerability from nvd – Published: 2026-08-27 05:20 – Updated: 2026-08-27 14:15
    VLAI
    Title
    Admin password disclosed in BrokerNotAliveException message
    Summary
    When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-27 14:15 UTC
    CWE
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.1.0 (custom)
    Affected: 4.0.0 , ≤ 4.0.4 (custom)
    Affected: 3.2.0 , ≤ 3.2.12 (custom)
    Affected: 0 , ≤ 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59271",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-27T14:15:12.907398Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-209",
                    "description": "CWE-209 Generation of Error Message Containing Sensitive Information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-27T14:15:39.893Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.0.4",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "3.2.12",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "2.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eWhen the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
                }
              ],
              "value": "When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-209 Generation of Error Message Containing Sensitive Information",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-27T05:21:42.676Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-59271"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Admin password disclosed in BrokerNotAliveException message"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-59271",
        "datePublished": "2026-08-27T05:20:34.133Z",
        "dateReserved": "2026-07-04T18:13:09.972Z",
        "dateUpdated": "2026-08-27T14:15:39.893Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-47860 (GCVE-0-2026-47860)

    Vulnerability from nvd – Published: 2026-08-26 23:28 – Updated: 2026-08-27 14:48
    VLAI
    Title
    Unbounded decompression of attacker-supplied compressed message bodies
    Summary
    An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-27 14:47 UTC
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.1.0 (custom)
    Affected: 4.0.0 , ≤ 4.0.4 (custom)
    Affected: 3.2.0 , ≤ 3.2.12 (custom)
    Affected: 0 , ≤ 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-47860",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-27T14:47:40.938402Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-27T14:48:04.818Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.0.4",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "3.2.12",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "2.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
                }
              ],
              "value": "An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification, Decompression Bomb)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-26T23:28:46.607Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-47860"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Unbounded decompression of attacker-supplied compressed message bodies"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-47860",
        "datePublished": "2026-08-26T23:28:46.607Z",
        "dateReserved": "2026-05-20T10:00:55.156Z",
        "dateUpdated": "2026-08-27T14:48:04.818Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-41714 (GCVE-0-2026-41714)

    Vulnerability from nvd – Published: 2026-06-09 23:48 – Updated: 2026-06-27 21:14
    VLAI
    Title
    In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager
    Summary
    Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-10 13:01 UTC
    CWE
    • CWE-295 - Improper Certificate Validation
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.0.0 , < 4.0.3.1 (custom)
    Affected: 3.2.0 , < 3.2.10.1 (custom)
    Affected: 3.1.0 , < 3.1.16 (custom)
    Affected: 2.4.0 , < 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-41714",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-10T13:01:58.139774Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-10T13:02:07.351Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "lessThan": "4.0.3.1",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "3.2.10.1",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "3.1.16",
                  "status": "affected",
                  "version": "3.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "2.4.18",
                  "status": "affected",
                  "version": "2.4.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri(\"amqps://...\") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
                }
              ],
              "value": "Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri(\"amqps://...\") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "Applications that configure AMQP broker connections via setUri(\"amqps://...\") without calling setUseSSL(true) receive TLS encryption with no certificate validation or hostname verification."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-295",
                  "description": "CWE-295: Improper Certificate Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-27T21:14:02.581Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-41714"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "In Spring AMQP the RabbitConnectionFactoryBean.setUri(\"amqps://...\") bypasses secure SSL setup, uses TrustEverythingTrustManager",
          "x_generator": {
            "engine": "Vulnogram 1.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-41714",
        "datePublished": "2026-06-09T23:48:16.317Z",
        "dateReserved": "2026-04-22T06:21:37.020Z",
        "dateUpdated": "2026-06-27T21:14:02.581Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-41701 (GCVE-0-2026-41701)

    Vulnerability from nvd – Published: 2026-06-09 23:47 – Updated: 2026-06-23 20:48
    VLAI
    Title
    In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
    Summary
    Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-10 13:04 UTC
    CWE
    • CWE-330 - Use of Insufficiently Random Values
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.0.0 , < 4.0.3.1 (custom)
    Affected: 3.2.0 , < 3.2.10.1 (custom)
    Affected: 3.1.0 , < 3.1.16 (custom)
    Affected: 2.4.0 , < 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-41701",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-10T13:04:42.963494Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-10T13:04:52.283Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "lessThan": "4.0.3.1",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "3.2.10.1",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "3.1.16",
                  "status": "affected",
                  "version": "3.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "2.4.18",
                  "status": "affected",
                  "version": "2.4.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
                }
              ],
              "value": "Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "An attacker who can inject messages into a fixed reply queue can predict sequential correlation IDs and poison replies, resulting in integrity or confidentiality impacts."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-330",
                  "description": "CWE-330: Use of Insufficiently Random Values",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-23T20:48:22.061Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-41701"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues",
          "x_generator": {
            "engine": "Vulnogram 1.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-41701",
        "datePublished": "2026-06-09T23:47:54.996Z",
        "dateReserved": "2026-04-22T06:21:22.982Z",
        "dateUpdated": "2026-06-23T20:48:22.061Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2023-34050 (GCVE-0-2023-34050)

    Vulnerability from nvd – Published: 2023-10-19 07:11 – Updated: 2024-09-12 17:58
    VLAI
    Title
    Spring AMQP Deserialization Vulnerability
    Summary
    In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-12 17:58 UTC
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 1.0.0 , < 2.4.17 (2.4.17)
    Affected: 3.0.0 , < 3.0.10 (3.0.10)
    Create a notification for this product.
    Date Public
    2023-10-18 06:52
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T16:01:52.410Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://spring.io/security/cve-2023-34050"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-34050",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-12T17:58:30.805271Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-12T17:58:46.718Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "MacOS",
                "Linux",
                "iOS",
                "Android",
                "x86",
                "ARM",
                "64 bit",
                "Windows",
                "32 bit"
              ],
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "lessThan": "2.4.17",
                  "status": "affected",
                  "version": "1.0.0",
                  "versionType": "2.4.17"
                },
                {
                  "lessThan": "3.0.10",
                  "status": "affected",
                  "version": "3.0.0",
                  "versionType": "3.0.10"
                }
              ]
            }
          ],
          "datePublic": "2023-10-18T06:52:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\n\n\n\n\n\n\n\n\n\n\n\u003cp\u003eIn spring AMQP versions 1.0.0 to\n2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class\nnames were added to Spring AMQP, allowing users to lock down deserialization of\ndata in messages from untrusted sources; however by default, when no allowed\nlist was provided, all classes could be deserialized.\u003c/p\u003e\n\n\u003cp\u003eSpecifically, an application is\nvulnerable if\u003c/p\u003e\n\n\u003cul\u003e\n \u003cli\u003ethe\n     SimpleMessageConverter or SerializerMessageConverter is used\u003c/li\u003e\n \u003cli\u003ethe user\n     does not configure allowed list patterns\u003c/li\u003e\n \u003cli\u003euntrusted\n     message originators gain permissions to write messages to the RabbitMQ\n     broker to send malicious content\u003c/li\u003e\n\u003c/ul\u003e\n\n\n\n\n\n"
                }
              ],
              "value": "\n\n\n\n\n\n\n\n\n\nIn spring AMQP versions 1.0.0 to\n2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class\nnames were added to Spring AMQP, allowing users to lock down deserialization of\ndata in messages from untrusted sources; however by default, when no allowed\nlist was provided, all classes could be deserialized.\n\n\n\nSpecifically, an application is\nvulnerable if\n\n\n\n\n   *  the\n     SimpleMessageConverter or SerializerMessageConverter is used\n\n   *  the user\n     does not configure allowed list patterns\n\n   *  untrusted\n     message originators gain permissions to write messages to the RabbitMQ\n     broker to send malicious content\n\n\n\n\n\n\n\n\n\n"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-10-19T07:11:35.038Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2023-34050"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Spring AMQP Deserialization Vulnerability",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2023-34050",
        "datePublished": "2023-10-19T07:11:35.038Z",
        "dateReserved": "2023-05-25T17:21:56.203Z",
        "dateUpdated": "2024-09-12T17:58:46.718Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CVE-2026-59320 (GCVE-0-2026-59320)

    Vulnerability from cvelistv5 – Published: 2026-08-27 18:04 – Updated: 2026-08-28 22:46
    VLAI
    Title
    In Spring AMQP the link credit never replenished on listener exception path
    Summary
    When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-28 22:43 UTC
    CWE
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.1.0 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59320",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-28T22:43:09.232563Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-772",
                    "description": "CWE-772 Missing Release of Resource after Effective Lifetime",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-28T22:46:54.662Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eWhen a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003c/p\u003e"
                }
              ],
              "value": "When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.\nSpring AMQP 4.1.0"
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver\u0027s credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-772 Missing Release of Resource after Effective Lifetime",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-27T18:04:47.999Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-59320"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "In Spring AMQP the link credit never replenished on listener exception path"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-59320",
        "datePublished": "2026-08-27T18:04:47.999Z",
        "dateReserved": "2026-07-04T18:14:10.167Z",
        "dateUpdated": "2026-08-28T22:46:54.662Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-59272 (GCVE-0-2026-59272)

    Vulnerability from cvelistv5 – Published: 2026-08-27 16:41 – Updated: 2026-08-28 03:55
    VLAI
    Title
    Log4j2 AmqpAppender disables TLS hostname verification by default
    Summary
    Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-27 00:00 UTC
    CWE
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.1.0 (custom)
    Affected: 4.0.0 , ≤ 4.0.4 (custom)
    Affected: 3.2.0 , ≤ 3.2.12 (custom)
    Affected: 0 , ≤ 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59272",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-27T00:00:00+00:00",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-297",
                    "description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-28T03:55:35.123Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.0.4",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "3.2.12",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "2.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAny application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
                }
              ],
              "value": "Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-27T16:41:08.650Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-59272"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Log4j2 AmqpAppender disables TLS hostname verification by default"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-59272",
        "datePublished": "2026-08-27T16:41:08.650Z",
        "dateReserved": "2026-07-04T18:13:09.972Z",
        "dateUpdated": "2026-08-28T03:55:35.123Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-59275 (GCVE-0-2026-59275)

    Vulnerability from cvelistv5 – Published: 2026-08-27 05:20 – Updated: 2026-08-28 03:55
    VLAI
    Title
    Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)
    Summary
    A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-27 00:00 UTC
    CWE
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.1.0 (custom)
    Affected: 4.0.0 , ≤ 4.0.4 (custom)
    Affected: 3.2.0 , ≤ 3.2.12 (custom)
    Affected: 0 , ≤ 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59275",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-27T00:00:00+00:00",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-502",
                    "description": "CWE-502 Deserialization of Untrusted Data",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-28T03:55:28.836Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.0.4",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "3.2.12",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "2.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
                }
              ],
              "value": "A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread \u2014 full availability loss for every workload co-located in that process."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.6,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-502 Deserialization of Untrusted Data",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-27T05:21:43.569Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-59275"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-59275",
        "datePublished": "2026-08-27T05:20:36.022Z",
        "dateReserved": "2026-07-04T18:13:09.972Z",
        "dateUpdated": "2026-08-28T03:55:28.836Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-59271 (GCVE-0-2026-59271)

    Vulnerability from cvelistv5 – Published: 2026-08-27 05:20 – Updated: 2026-08-27 14:15
    VLAI
    Title
    Admin password disclosed in BrokerNotAliveException message
    Summary
    When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-27 14:15 UTC
    CWE
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.1.0 (custom)
    Affected: 4.0.0 , ≤ 4.0.4 (custom)
    Affected: 3.2.0 , ≤ 3.2.12 (custom)
    Affected: 0 , ≤ 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59271",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-27T14:15:12.907398Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-209",
                    "description": "CWE-209 Generation of Error Message Containing Sensitive Information",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-27T14:15:39.893Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.0.4",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "3.2.12",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "2.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eWhen the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
                }
              ],
              "value": "When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-209 Generation of Error Message Containing Sensitive Information",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-27T05:21:42.676Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-59271"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Admin password disclosed in BrokerNotAliveException message"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-59271",
        "datePublished": "2026-08-27T05:20:34.133Z",
        "dateReserved": "2026-07-04T18:13:09.972Z",
        "dateUpdated": "2026-08-27T14:15:39.893Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-47860 (GCVE-0-2026-47860)

    Vulnerability from cvelistv5 – Published: 2026-08-26 23:28 – Updated: 2026-08-27 14:48
    VLAI
    Title
    Unbounded decompression of attacker-supplied compressed message bodies
    Summary
    An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-27 14:47 UTC
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.1.0 (custom)
    Affected: 4.0.0 , ≤ 4.0.4 (custom)
    Affected: 3.2.0 , ≤ 3.2.12 (custom)
    Affected: 0 , ≤ 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-47860",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-27T14:47:40.938402Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-27T14:48:04.818Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "4.0.4",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "3.2.12",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "2.4.18",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.\u003c/p\u003e\u003cp\u003eSpring AMQP 4.1.0\u003cbr/\u003eSpring AMQP 4.0.0 - 4.0.4\u003cbr/\u003eSpring AMQP 3.2.0 - 3.2.12\u003cbr/\u003eSpring AMQP 2.4.18 and earlier\u003c/p\u003e"
                }
              ],
              "value": "An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.\nSpring AMQP 4.1.0\nSpring AMQP 4.0.0 - 4.0.4\nSpring AMQP 3.2.0 - 3.2.12\nSpring AMQP 2.4.18 and earlier"
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "description": "CWE-409 Improper Handling of Highly Compressed Data (Data Amplification, Decompression Bomb)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-26T23:28:46.607Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-47860"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Unbounded decompression of attacker-supplied compressed message bodies"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-47860",
        "datePublished": "2026-08-26T23:28:46.607Z",
        "dateReserved": "2026-05-20T10:00:55.156Z",
        "dateUpdated": "2026-08-27T14:48:04.818Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-41714 (GCVE-0-2026-41714)

    Vulnerability from cvelistv5 – Published: 2026-06-09 23:48 – Updated: 2026-06-27 21:14
    VLAI
    Title
    In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager
    Summary
    Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-10 13:01 UTC
    CWE
    • CWE-295 - Improper Certificate Validation
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.0.0 , < 4.0.3.1 (custom)
    Affected: 3.2.0 , < 3.2.10.1 (custom)
    Affected: 3.1.0 , < 3.1.16 (custom)
    Affected: 2.4.0 , < 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-41714",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-10T13:01:58.139774Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-10T13:02:07.351Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "lessThan": "4.0.3.1",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "3.2.10.1",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "3.1.16",
                  "status": "affected",
                  "version": "3.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "2.4.18",
                  "status": "affected",
                  "version": "2.4.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri(\"amqps://...\") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
                }
              ],
              "value": "Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri(\"amqps://...\") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "Applications that configure AMQP broker connections via setUri(\"amqps://...\") without calling setUseSSL(true) receive TLS encryption with no certificate validation or hostname verification."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-295",
                  "description": "CWE-295: Improper Certificate Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-27T21:14:02.581Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-41714"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "In Spring AMQP the RabbitConnectionFactoryBean.setUri(\"amqps://...\") bypasses secure SSL setup, uses TrustEverythingTrustManager",
          "x_generator": {
            "engine": "Vulnogram 1.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-41714",
        "datePublished": "2026-06-09T23:48:16.317Z",
        "dateReserved": "2026-04-22T06:21:37.020Z",
        "dateUpdated": "2026-06-27T21:14:02.581Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-41701 (GCVE-0-2026-41701)

    Vulnerability from cvelistv5 – Published: 2026-06-09 23:47 – Updated: 2026-06-23 20:48
    VLAI
    Title
    In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
    Summary
    Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-06-10 13:04 UTC
    CWE
    • CWE-330 - Use of Insufficiently Random Values
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 4.0.0 , < 4.0.3.1 (custom)
    Affected: 3.2.0 , < 3.2.10.1 (custom)
    Affected: 3.1.0 , < 3.1.16 (custom)
    Affected: 2.4.0 , < 2.4.18 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-41701",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-10T13:04:42.963494Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-10T13:04:52.283Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "lessThan": "4.0.3.1",
                  "status": "affected",
                  "version": "4.0.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "3.2.10.1",
                  "status": "affected",
                  "version": "3.2.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "3.1.16",
                  "status": "affected",
                  "version": "3.1.0",
                  "versionType": "custom"
                },
                {
                  "lessThan": "2.4.18",
                  "status": "affected",
                  "version": "2.4.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
                }
              ],
              "value": "Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.\n\nAffected versions:\nSpring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "An attacker who can inject messages into a fixed reply queue can predict sequential correlation IDs and poison replies, resulting in integrity or confidentiality impacts."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-330",
                  "description": "CWE-330: Use of Insufficiently Random Values",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-23T20:48:22.061Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2026-41701"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues",
          "x_generator": {
            "engine": "Vulnogram 1.0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2026-41701",
        "datePublished": "2026-06-09T23:47:54.996Z",
        "dateReserved": "2026-04-22T06:21:22.982Z",
        "dateUpdated": "2026-06-23T20:48:22.061Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2023-34050 (GCVE-0-2023-34050)

    Vulnerability from cvelistv5 – Published: 2023-10-19 07:11 – Updated: 2024-09-12 17:58
    VLAI
    Title
    Spring AMQP Deserialization Vulnerability
    Summary
    In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-09-12 17:58 UTC
    References
    Impacted products
    Vendor Product Version
    Spring Spring AMQP Affected: 1.0.0 , < 2.4.17 (2.4.17)
    Affected: 3.0.0 , < 3.0.10 (3.0.10)
    Create a notification for this product.
    Date Public
    2023-10-18 06:52
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T16:01:52.410Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://spring.io/security/cve-2023-34050"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-34050",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-12T17:58:30.805271Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-12T17:58:46.718Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "MacOS",
                "Linux",
                "iOS",
                "Android",
                "x86",
                "ARM",
                "64 bit",
                "Windows",
                "32 bit"
              ],
              "product": "Spring AMQP",
              "vendor": "Spring",
              "versions": [
                {
                  "lessThan": "2.4.17",
                  "status": "affected",
                  "version": "1.0.0",
                  "versionType": "2.4.17"
                },
                {
                  "lessThan": "3.0.10",
                  "status": "affected",
                  "version": "3.0.0",
                  "versionType": "3.0.10"
                }
              ]
            }
          ],
          "datePublic": "2023-10-18T06:52:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\n\n\n\n\n\n\n\n\n\n\n\u003cp\u003eIn spring AMQP versions 1.0.0 to\n2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class\nnames were added to Spring AMQP, allowing users to lock down deserialization of\ndata in messages from untrusted sources; however by default, when no allowed\nlist was provided, all classes could be deserialized.\u003c/p\u003e\n\n\u003cp\u003eSpecifically, an application is\nvulnerable if\u003c/p\u003e\n\n\u003cul\u003e\n \u003cli\u003ethe\n     SimpleMessageConverter or SerializerMessageConverter is used\u003c/li\u003e\n \u003cli\u003ethe user\n     does not configure allowed list patterns\u003c/li\u003e\n \u003cli\u003euntrusted\n     message originators gain permissions to write messages to the RabbitMQ\n     broker to send malicious content\u003c/li\u003e\n\u003c/ul\u003e\n\n\n\n\n\n"
                }
              ],
              "value": "\n\n\n\n\n\n\n\n\n\nIn spring AMQP versions 1.0.0 to\n2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class\nnames were added to Spring AMQP, allowing users to lock down deserialization of\ndata in messages from untrusted sources; however by default, when no allowed\nlist was provided, all classes could be deserialized.\n\n\n\nSpecifically, an application is\nvulnerable if\n\n\n\n\n   *  the\n     SimpleMessageConverter or SerializerMessageConverter is used\n\n   *  the user\n     does not configure allowed list patterns\n\n   *  untrusted\n     message originators gain permissions to write messages to the RabbitMQ\n     broker to send malicious content\n\n\n\n\n\n\n\n\n\n"
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-10-19T07:11:35.038Z",
            "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
            "shortName": "vmware"
          },
          "references": [
            {
              "url": "https://spring.io/security/cve-2023-34050"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Spring AMQP Deserialization Vulnerability",
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "assignerShortName": "vmware",
        "cveId": "CVE-2023-34050",
        "datePublished": "2023-10-19T07:11:35.038Z",
        "dateReserved": "2023-05-25T17:21:56.203Z",
        "dateUpdated": "2024-09-12T17:58:46.718Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }

    CERTFR-2026-AVI-0719

    Vulnerability from certfr_avis - Published: 2026-06-10 - Updated: 2026-06-10

    De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un contournement de la politique de sécurité et un déni de service.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Spring Spring Data KeyValue Data KeyValue versions 3.3.x antérieures à 3.3.17
    Spring Data REST Data REST versions 4.3.x antérieures à 4.3.17
    Spring Spring Data KeyValue Data KeyValue versions 3.4.x antérieures à 3.4.15
    Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.5.x antérieures à 3.5.12
    Spring Spring Data Relational Data Relational versions 3.4.x antérieures à 3.4.15
    Spring Spring AMQP AMQP versions 4.0.x antérieures à 4.0.4
    Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 4.0.x antérieures à 4.0.6
    Spring Spring Data MongoDB Data MongoDB versions 3.4.x antérieures à 3.4.20
    Spring Spring AMQP AMQP versions antérieures à 4.0.3.1
    Spring Spring AMQP AMQP versions antérieures à 3.2.10.1
    Spring Spring Data Relational Data Relational versions 3.3.x antérieures à 3.3.17
    Spring Spring Data Relational Data Relational versions 4.0.x antérieures à 4.0.6
    Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.3.x antérieures à 3.3.17
    Spring Spring Data KeyValue Data KeyValue versions 3.5.x antérieures à 3.5.12
    Spring Spring AMQP AMQP versions 2.4.x antérieures à 2.4.18
    Spring Spring Security Security versions 7.0.x antérieures à 7.0.6
    Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 2.7.x antérieures à 2.7.20
    Spring Spring Data MongoDB Data MongoDB versions 4.3.x antérieures à 4.3.17
    Spring Spring Security Security versions 1.5.x antérieures à 1.5.8
    Spring Spring Security Security versions 6.3.x antérieures à 6.3.17
    Spring Spring Data MongoDB Data MongoDB versions 4.5.x antérieures à 4.5.12
    Spring Data REST Data REST versions 3.7.x antérieures à 3.7.20
    Spring Data REST Data REST versions 4.5.x antérieures à 4.5.12
    Spring Data REST Data REST versions 5.0.x antérieures à 5.0.6
    Spring Spring Data Relational Data Relational versions 3.5.x antérieures à 3.5.12
    Spring Spring AMQP AMQP versions 3.1.x antérieures à 3.1.16
    Spring Spring Data Relational Data Relational versions 2.4.x antérieures à 2.4.20
    Spring Data REST Data REST versions 4.4.x antérieures à 4.4.15
    Spring Spring Security Security versions 5.7.x antérieures à 5.7.24
    Spring Spring Data KeyValue Data KeyValue versions 4.0.x antérieures à 4.0.6
    Spring Spring Data MongoDB Data MongoDB versions 4.4.x antérieures à 4.4.15
    Spring Spring Data KeyValue Data KeyValue versions 2.7.x antérieures à 2.7.20
    Spring Spring Security Security versions 6.5.x antérieures à 6.5.11
    Spring Spring Data MongoDB Data MongoDB versions 5.0.x antérieures à 5.0.6
    Spring Spring AMQP AMQP versions 3.2.x antérieures à 3.2.11
    Spring Spring Security Security versions 6.4.x antérieures à 6.4.17
    Spring Spring Data Commons Data Commons (affecte tous les modules Data store de manière transitive) versions 3.4.x antérieures à 3.4.15
    Spring Spring Security Security versions 5.8.x antérieures à 5.8.26
    References

    Show details on source website

    {
      "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
      "affected_systems": [
        {
          "description": "Data KeyValue versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
          "product": {
            "name": "Spring Data KeyValue",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data REST versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
          "product": {
            "name": "Data REST",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data KeyValue versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
          "product": {
            "name": "Spring Data KeyValue",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
          "product": {
            "name": "Spring Data Commons",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data Relational versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
          "product": {
            "name": "Spring Data Relational",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "AMQP versions 4.0.x ant\u00e9rieures \u00e0 4.0.4",
          "product": {
            "name": "Spring AMQP",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
          "product": {
            "name": "Spring Data Commons",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data MongoDB versions 3.4.x ant\u00e9rieures \u00e0 3.4.20",
          "product": {
            "name": "Spring Data MongoDB",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "AMQP versions ant\u00e9rieures \u00e0 4.0.3.1",
          "product": {
            "name": "Spring AMQP",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "AMQP versions ant\u00e9rieures \u00e0 3.2.10.1",
          "product": {
            "name": "Spring AMQP",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data Relational versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
          "product": {
            "name": "Spring Data Relational",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data Relational versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
          "product": {
            "name": "Spring Data Relational",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.3.x ant\u00e9rieures \u00e0 3.3.17",
          "product": {
            "name": "Spring Data Commons",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data KeyValue versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
          "product": {
            "name": "Spring Data KeyValue",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "AMQP versions 2.4.x ant\u00e9rieures \u00e0 2.4.18",
          "product": {
            "name": "Spring AMQP",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Security versions 7.0.x ant\u00e9rieures \u00e0 7.0.6",
          "product": {
            "name": "Spring Security",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
          "product": {
            "name": "Spring Data Commons",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data MongoDB versions 4.3.x ant\u00e9rieures \u00e0 4.3.17",
          "product": {
            "name": "Spring Data MongoDB",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Security versions 1.5.x ant\u00e9rieures \u00e0 1.5.8",
          "product": {
            "name": "Spring Security",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Security versions 6.3.x ant\u00e9rieures \u00e0 6.3.17",
          "product": {
            "name": "Spring Security",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data MongoDB versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
          "product": {
            "name": "Spring Data MongoDB",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data REST versions 3.7.x ant\u00e9rieures \u00e0 3.7.20",
          "product": {
            "name": "Data REST",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data REST versions 4.5.x ant\u00e9rieures \u00e0 4.5.12",
          "product": {
            "name": "Data REST",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data REST versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
          "product": {
            "name": "Data REST",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data Relational versions 3.5.x ant\u00e9rieures \u00e0 3.5.12",
          "product": {
            "name": "Spring Data Relational",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "AMQP versions 3.1.x ant\u00e9rieures \u00e0 3.1.16",
          "product": {
            "name": "Spring AMQP",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data Relational versions 2.4.x ant\u00e9rieures \u00e0 2.4.20",
          "product": {
            "name": "Spring Data Relational",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data REST versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
          "product": {
            "name": "Data REST",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Security versions 5.7.x ant\u00e9rieures \u00e0 5.7.24",
          "product": {
            "name": "Spring Security",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data KeyValue versions 4.0.x ant\u00e9rieures \u00e0 4.0.6",
          "product": {
            "name": "Spring Data KeyValue",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data MongoDB versions 4.4.x ant\u00e9rieures \u00e0 4.4.15",
          "product": {
            "name": "Spring Data MongoDB",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data KeyValue versions 2.7.x ant\u00e9rieures \u00e0 2.7.20",
          "product": {
            "name": "Spring Data KeyValue",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Security versions 6.5.x ant\u00e9rieures \u00e0 6.5.11",
          "product": {
            "name": "Spring Security",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data MongoDB versions 5.0.x ant\u00e9rieures \u00e0 5.0.6",
          "product": {
            "name": "Spring Data MongoDB",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "AMQP versions 3.2.x ant\u00e9rieures \u00e0 3.2.11",
          "product": {
            "name": "Spring AMQP",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Security versions 6.4.x ant\u00e9rieures \u00e0 6.4.17",
          "product": {
            "name": "Spring Security",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Data Commons (affecte tous les modules Data store de mani\u00e8re transitive) versions 3.4.x ant\u00e9rieures \u00e0 3.4.15",
          "product": {
            "name": "Spring Data Commons",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        },
        {
          "description": "Security versions 5.8.x ant\u00e9rieures \u00e0 5.8.26",
          "product": {
            "name": "Spring Security",
            "vendor": {
              "name": "Spring",
              "scada": false
            }
          }
        }
      ],
      "affected_systems_content": "",
      "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
      "cves": [
        {
          "name": "CVE-2026-41716",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41716"
        },
        {
          "name": "CVE-2026-40993",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40993"
        },
        {
          "name": "CVE-2026-41717",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41717"
        },
        {
          "name": "CVE-2026-41721",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41721"
        },
        {
          "name": "CVE-2026-41695",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41695"
        },
        {
          "name": "CVE-2026-41729",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41729"
        },
        {
          "name": "CVE-2026-41719",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41719"
        },
        {
          "name": "CVE-2026-41697",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41697"
        },
        {
          "name": "CVE-2026-41008",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41008"
        },
        {
          "name": "CVE-2026-41694",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41694"
        },
        {
          "name": "CVE-2026-41696",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41696"
        },
        {
          "name": "CVE-2026-41711",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41711"
        },
        {
          "name": "CVE-2026-40988",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40988"
        },
        {
          "name": "CVE-2026-41003",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41003"
        },
        {
          "name": "CVE-2026-41701",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41701"
        }
      ],
      "initial_release_date": "2026-06-10T00:00:00",
      "last_revision_date": "2026-06-10T00:00:00",
      "links": [],
      "reference": "CERTFR-2026-AVI-0719",
      "revisions": [
        {
          "description": "Version initiale",
          "revision_date": "2026-06-10T00:00:00.000000"
        }
      ],
      "risks": [
        {
          "description": "Ex\u00e9cution de code arbitraire"
        },
        {
          "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
        },
        {
          "description": "D\u00e9ni de service"
        },
        {
          "description": "Contournement de la politique de s\u00e9curit\u00e9"
        }
      ],
      "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Spring. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, un contournement de la politique de s\u00e9curit\u00e9 et un d\u00e9ni de service.",
      "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Spring",
      "vendor_advisories": [
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41003",
          "url": "https://spring.io/security/cve-2026-41003"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41696",
          "url": "https://spring.io/security/cve-2026-41696"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41697",
          "url": "https://spring.io/security/cve-2026-41697"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41716",
          "url": "https://spring.io/security/cve-2026-41716"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41721",
          "url": "https://spring.io/security/cve-2026-41721"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41695",
          "url": "https://spring.io/security/cve-2026-41695"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41694",
          "url": "https://spring.io/security/cve-2026-41694"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41711",
          "url": "https://spring.io/security/cve-2026-41711"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41008",
          "url": "https://spring.io/security/cve-2026-41008"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41729",
          "url": "https://spring.io/security/cve-2026-41729"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41701",
          "url": "https://spring.io/security/cve-2026-41701"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40993",
          "url": "https://spring.io/security/cve-2026-40993"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41719",
          "url": "https://spring.io/security/cve-2026-41719"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-40988",
          "url": "https://spring.io/security/cve-2026-40988"
        },
        {
          "published_at": "2026-06-09",
          "title": "Bulletin de s\u00e9curit\u00e9 Spring cve-2026-41717",
          "url": "https://spring.io/security/cve-2026-41717"
        }
      ]
    }