Insecure Randomness

Overview org.springframework.amqp:spring-amqp is a package that provides support for using Spring and Java with AMQP 0.9.1, and in particular RabbitMQ. Affected versions of this package are vulnerable to Insecure Randomness. via the sendAndReceive function when using a fixed reply queue, due to...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +99 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=4.0.0-m1, <=4.0.3)

org.springframework.amqp:spring-amqp MAVEN version =4.0.0-m1, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41701 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAMQP-18324292...

GHSA-P5F7-RJHP-PXVC Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

EUVD-2026-35895

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

br.jus.stf.digital:core (>=0.2.0, <=1.6.0), guru.springframework:page-view-client (0.0.2) +4 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.0.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - br.jus.stf.digital:core =0.2.0, =0.0.1, =1.5.0.release, =1.5.1.release Source...

br.jus.stf.digital:core (>=2.0.0, <=2.3.1), com.ecfront.dew:logger (>=1.1.0, <=1.1.4) +78 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.1.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - br.jus.stf.digital:core =2.0.0, =1.1.0, =1.1.0, =1.0.2-release, =1.0.5-release,...

com.github.lodsve:lodsve-amqp (>=2.5.8, <=2.5.9), org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.0.2, <=5.0.10) +3 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.lodsve:lodsve-amqp =2.5.8, =5.0.2, =5.0.10 -...

org.springframework.amqp:spring-rabbit (1.5.4.release), org.springframework.boot:spring-boot-starter-amqp (1.3.3.release) potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.5.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.5.4.release -...

org.springframework.amqp:spring-rabbit (1.6.9.release), org.springframework.amqp:spring-rabbit-test (1.6.9.release) +1 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.9.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.6.9.release -...

com.avides.spring:spring-amqp-utils (1.0.0.release), com.github.jingxiaohu:platform_base (1.0.0) +108 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.avides.spring:spring-amqp-utils 1.0.0.release -...

Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....

Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

org.springframework.amqp:spring-rabbit (1.5.4.release), org.springframework.boot:spring-boot-starter-amqp (1.3.3.release) potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.5.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.5.4.release -...

org.springframework.amqp:spring-rabbit (1.3.8.release) potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.3.8.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.8.release Source cves: CVE-2026-4170...

org.springframework.amqp:spring-rabbit (1.3.4.release), org.springframework.boot:spring-boot-starter-amqp (>=1.1.0.release, <=1.1.3.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.3.4.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.4.release -...

com.github.lodsve:lodsve-amqp (2.5.10), com.itelg.spring:spring-rabbitmq-actuator (0.5.0-release) +75 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.5.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.lodsve:lodsve-amqp 2.5.10 - com.itelg.spring:spring-rabbitmq-actuato...

org.springframework.amqp:spring-rabbit (1.3.1.release) potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.3.1.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.1.release Source cves: CVE-2026-4170...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), br.com.itsme:commons (>=0.0.4-alpha, <=0.0.5-alpha) +944 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (>=2.0.0.release, <=2.4.17)

org.springframework.amqp:spring-amqp MAVEN version =2.0.0.release, =0.5.0, =0.0.4-alpha, =0.1.0.beta, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =1.2.0-release, =1.0.1, =1.0.0, =2.1.0 and more Source cves: CVE-2026-41714 Source advisory: GHSA-P8QJ-FJ6R-W7Q9...

io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.6.1, <=5.6.3), org.springframework.amqp:spring-rabbit (1.7.12.release) +2 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.12.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.zipkin.brave:brave-instrumentation-spring-rabbit =5.6.1, =5.6.3 -...

org.springframework.amqp:spring-rabbit (1.5.5.release), org.springframework.boot:spring-boot-starter-amqp (1.3.4.release) potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.5.5.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.5.5.release -...