com.github.double-bin:commons-spring-boot-starter (1.0.1), com.netshoes:spring-cloud-sleuth-amqp (>=0.8, <=0.9) +18 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.2.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.github.double-bin:commons-spring-boot-starter 1.0.1 -...

org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.1.0-rc4, <=5.1.9), org.springframework.amqp:spring-rabbit (1.6.8.release) +3 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.6.8.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.apereo.cas:cas-server-core-configuration-cloud-amqp =5.1.0-rc4,...

com.bq.corbel.lib:rabbitmq (>=0.9.0, <=0.10.0), com.bq.corbel.lib:ws (>=0.20.0, <=0.23.0) +29 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.4.5.release)

org.springframework.amqp:spring-amqp MAVEN version 1.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.bq.corbel.lib:rabbitmq =0.9.0, =0.20.0, =1.31.1, =1.27.1, =1.31.0, =1.31.1,...

cc.voox:publisher (0.1.2.ga), org.springframework.amqp:spring-rabbit (1.2.2.release) +2 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.2.2.release)

org.springframework.amqp:spring-amqp MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cc.voox:publisher 0.1.2.ga - org.springframework.amqp:spring-rabbit 1.2.2.relea...

org.resthub:spring-amqp-hessian (1.0.0), org.springframework.amqp:spring-rabbit (1.1.3.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.1.3.release)

org.springframework.amqp:spring-amqp MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.resthub:spring-amqp-hessian 1.0.0 - org.springframework.amqp:spring-rabbit...

cn.hdfk7.boot:hdfk7-boot-starter-common (>=1.0.0, <=3.0.3), cn.herodotus.engine:message-rabbitmq-spring-boot-starter (>=3.2.0.0, <=3.3.0.6) +279 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (>=3.1.0, <=3.1.12)

org.springframework.amqp:spring-amqp MAVEN version =3.1.0, =1.0.0, =3.2.0.0, =3.3.0.0, =5.0.7, =0.1.0, =0.1.0, =2.1.21, =0.12.2, =0.10.0, =5.13.0, =5.13.2 and more Source cves: CVE-2026-41714 Source advisory: GHSA-P8QJ-FJ6R-W7Q9...

org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.2.0-rc1, <=5.2.0-rc3), org.springframework.amqp:spring-rabbit (1.6.10.release) +3 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.10.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.apereo.cas:cas-server-core-configuration-cloud-amqp =5.2.0-rc1,...

com.ahome-it:ahome-tooling-server-core (>=1.1.19-release, <=1.1.31-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.23-release, <=1.1.27-release) +40 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.6.5.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.19-release, =1.1.23-release,...

com.ahome-it:ahome-tooling-server-core (1.1.0-release), com.ahome-it:ahome-tooling-server-hazelcast (1.1.0-release) +151 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.5.6.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.ahome-it:ahome-tooling-server-core 1.1.0-release -...

io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.4.3, <=5.5.1), org.springframework.amqp:spring-rabbit (1.7.10.release) +5 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.7.10.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.zipkin.brave:brave-instrumentation-spring-rabbit =5.4.3, =5.5.1 -...

org.carewebframework:org.carewebframework.amqp.rabbitmq (>=4.0.0-rc1, <=4.0.8), org.springframework.amqp:spring-rabbit (1.4.2.release) +1 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.4.2.release)

org.springframework.amqp:spring-amqp MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.carewebframework:org.carewebframework.amqp.rabbitmq =4.0.0-rc1,...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +98 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=4.0.0, <=4.0.3)

org.springframework.amqp:spring-amqp MAVEN version =4.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41701 Source advisory: OSV:GHSA-P5F7-RJHP-PXVC...

org.springframework.amqp:spring-rabbit (1.3.1.release) potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.3.1.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.1.release Source cves: CVE-2026-4171...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +98 more potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (>=4.0.0, <=4.0.3)

org.springframework.amqp:spring-amqp MAVEN version =4.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41714 Source advisory: OSV:GHSA-P8QJ-FJ6R-W7Q9...

cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp (1.0.2), io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.6.4, <=5.7.0) +8 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.13.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cn.ttpai.framework:ttpai-rose-spring-boot-autoconfigure-amqp 1.0.2 -...

CVE-2026-41714: Improper Certificate Validation

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....

PT-2026-75996

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....

PT-2026-75993

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

CVE-2026-41701: Use of Insufficiently Random Values

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

CVE-2026-41714 In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....