CVE-2026-41701 In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

CVE-2026-41701

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

CVE-2026-41701 In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

cloud.hedou:abp-spring-boot-starter (>=1.0.0, <=1.0.1), cn.404z:tiny-task-spring-boot-starter (>=1.0.0, <=1.7.0) +449 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-rabbit (>=2.4.0, <=2.4.17)

org.springframework.amqp:spring-rabbit MAVEN version =2.4.0, =1.0.0, =1.0.0, =1.0.1, =1.2.3, =1.2.3, =1.2.3, =1.1.0, =0.0.2, =1.1.2, =1.1.0, =1.0.11, =1.0.12 and more Source cves: CVE-2026-41701 Source advisory: MEND:CVE-2026-41701...

cloud.wondrify:grails-rabbit-amqp-plugin (7.0.0), cn.hiapi:hiapi-core-application (1.0.8) +372 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-rabbit (>=3.2.0, <=3.2.10)

org.springframework.amqp:spring-rabbit MAVEN version =3.2.0, =2.0.1, =1.0.1-jdk21, =3.5.5, =3.5.0-jdk17-1.0.0, =0.7.0, =0.7.0, =0.2.0, =0.1.0-beta.1, =0.1.0 - com.buession.cas:cas-server-support-logging 4.0.0 and more Source cves: CVE-2026-41701 Source advisory: MEND:CVE-2026-41701...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +95 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-rabbit (>=4.0.0, <=4.0.3)

org.springframework.amqp:spring-rabbit MAVEN version =4.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41701 Source advisory: MEND:CVE-2026-41701...

cloud.wondrify:grails-rabbit-amqp-plugin (7.0.0), cn.hiapi:hiapi-core-application (1.0.8) +375 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=3.2.0, <=3.2.10)

org.springframework.amqp:spring-amqp MAVEN version =3.2.0, =2.0.1, =1.0.1-jdk21, =3.5.5, =3.5.0-jdk17-1.0.0, =0.7.0, =0.7.0, =0.2.0, =0.1.0-beta.1, =0.1.0 - com.buession.cas:cas-server-support-logging 4.0.0 and more Source cves: CVE-2026-41701 Source advisory: MEND:CVE-2026-41701...

CVE-2026-41701

CVE-2026-41701 affects Spring AMQP (RabbitTemplate) where correlation IDs for replies on fixed reply queues are generated by an internal simple counter, making them predictable. This data from NVD/CVE listings confirms the issue affects multiple versions (2.4.0–2.4.17, 3.1.0–3.1.15, 3.2.0–3.2.10,...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.1.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.1.0) +610 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-relational MAVEN version =3.4.0, =0.0.1, =0.0.1, =2.0.0-release, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0, =2.51.0 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697https://vulners.com/mend/MEND:CVE-...

cc.ddrpa.dorian.elias:elias-spring-boot-starter (>=2.5.0, <=2.5.3), cn.fantasticmao.mundo:mundo-data (>=1.0.9, <=1.0.10) +352 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=2.4.0, <=2.4.18)

org.springframework.data:spring-data-relational MAVEN version =2.4.0, =2.5.0, =1.0.9, =2.9.2.release, =0.1.8.jre11, =2.4.0, =1.5.0, =1.11.3.1, =1.12.2.0, =1.11.3.1, =1.2.0, =3.4.0, =3.4.0, =3.9.18 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

cn.dinodev:dinodev-spring-core (>=3.3.0, <=3.3.4), cn.dinodev:dinodev-spring-data (>=3.3.0, <=3.3.4) +325 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-relational MAVEN version =3.3.0, =3.3.0, =3.3.0, =15.0-release, =0.3.0, =1.5.3, =5.5.0, =5.5.0, =9.0.8, =9.0.8, =9.0.8, =9.0.8, =9.0.8, =9.0.8, =9.0.8, =9.0.8, =9.1.0 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

be.appify.prefab:prefab-annotation-processor (>=0.1.0, <=0.1.1), be.appify.prefab:prefab-core (>=0.1.0, <=0.1.1) +669 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-relational (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-relational MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

be.appify.prefab:prefab-annotation-processor (>=0.1.0, <=0.1.1), be.appify.prefab:prefab-core (>=0.1.0, <=0.1.1) +583 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-jdbc (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-jdbc MAVEN version =3.5.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.1.0, =2.1.21 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

cn.net.vidyo:dylink-data-jdbc (3.0.0.3.release), cn.workde:workde-core (>=2.0.0-release, <=2.0.3-release) +563 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-jdbc (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-jdbc MAVEN version =3.4.0, =2.0.0-release, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0, =1.1.0, =2.11.0, =1.1.0, =2.51.0 and more Source cves: CVE-2026-41697 Source advisory:...

cn.dinodev:dinodev-spring-core (>=3.3.0, <=3.3.4), cn.dinodev:dinodev-spring-data (>=3.3.0, <=3.3.4) +283 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-jdbc (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-jdbc MAVEN version =3.3.0, =3.3.0, =3.3.0, =0.3.0, =9.0.8, =9.0.8, =1.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.11 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

cc.ddrpa.dorian.elias:elias-spring-boot-starter (>=2.5.0, <=2.5.3), cn.fantasticmao.mundo:mundo-data (>=1.0.9, <=1.0.10) +294 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-jdbc (>=2.4.0, <=2.4.18)

org.springframework.data:spring-data-jdbc MAVEN version =2.4.0, =2.5.0, =1.0.9, =2.9.2.release, =0.1.8.jre11, =2.4.0, =1.12.2.0, =7.0.0, =7.0.0, =1.5.7, =1.0.8, =2.4.1, =2.4.1, =2.4.1, =2.4.9 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

com.github.fmjsjx:libcommon-r2dbc (>=3.17.0-rc1, <=4.2.2), com.github.fmjsjx:libcommon-r2dbc-kotlin (>=3.17.0-rc1, <=4.2.2) +43 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=4.0.0, <=4.0.5)

org.springframework.data:spring-data-r2dbc MAVEN version =4.0.0, =3.17.0-rc1, =3.17.0-rc1, =4.1.0-rc, =8.0.1, =8.0.1, =10.0.1, =10.0.1, =0.1.0, =0.1.0, =0.13.0, =1.8.0, =1.5.0-beta2, =1.0.4, =4.0.0, =5.1.3 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

ch.nexsol-tech.gateway:sample-gateway (>=1.2.0, <=1.3.1), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=1.2.0, <=1.3.1) +71 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=3.5.0, <=3.5.11)

org.springframework.data:spring-data-r2dbc MAVEN version =3.5.0, =1.2.0, =1.2.0, =15.14-release, =3.14.0-rc1, =3.14.0-rc1, =7.0.0, =7.0.0, =0.0.1, =1.0.4 and more Source cves: CVE-2026-41697 Source advisory: MEND:CVE-2026-41697...

ch.nexsol-tech.gateway:sample-gateway (>=0.0.1, <=1.1.0), ch.nexsol-tech.gateway:spring-cloud-gateway-database (>=0.0.1, <=1.1.0) +39 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-r2dbc MAVEN version =3.4.0, =0.0.1, =0.0.1, =3.11.0-rc1, =3.11.0-rc1, =6.0.0, =6.0.0, =0.6.0, =0.8.0 - io.eventuate.common:eventuate-common-spring-reactive-jdbc 0.21.0.release - io.eventuate.tram.core:eventuate-tram-reactive-consumer-jdbc 0.37.0.release -...

com.alcosi.nft:nft-api-gateway (>=15.0-release, <=15.12-release), com.google.cloud:spring-cloud-gcp-starter-sql-postgres-r2dbc (>=5.5.0, <=5.13.11) +29 more potentially affected by CVE-2026-41697 via org.springframework.data:spring-data-r2dbc (>=3.3.0, <=3.3.13)

org.springframework.data:spring-data-r2dbc MAVEN version =3.3.0, =15.0-release, =5.5.0, =5.5.0, =9.0.8, =9.0.8, =0.1.0, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.15, =0.4.16 and more Source cves: CVE-2026-41697htt...