CVE-2026-40971

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14 per vendor advisory...

CVE-2026-40971

Spring Boot RabbitMQ auto-configuration fails to verify hostnames when SSL bundles are enabled. Affected: Spring Boot 4.0.0–4.0.5 and 3.5.0–3.5.13. Root cause: hostname verification is not performed during broker connection, enabling potential interception or tampering on networks. Mitigation: pa...

CVE-2026-40971

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14 per vendor advisory...

CVE-2026-40971

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14 per vendor advisory...

CVE-2026-40971

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 fix 4.0.6, 3.5.0–3.5.13 fix 3.5.14 per vendor advisory...

PT-2026-35539

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5 Spring Boot versions 3.5.0 through 3.5.13 Description When configured to use an SSL bundle, the RabbitMQ auto-configuration fails to perform hostname verification during the connection process to the...

VMware Spring Boot 信任管理问题漏洞

VMware Spring Boot is an open-source framework developed by the American company VMware. There were security vulnerabilities in versions 4.0.0 to 4.0.5 and 3.5.0 to 3.5.13 of VMware Spring Boot. These vulnerabilities stemmed from an issue where RabbitMQ automatically configured SSL bundles withou...

RabbitMQ auto-configuration with an SSL bundle disables TLS hostname verification

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: victoriametrics, apko, flux-image-automation-controller, goreleaser, rabbitmq-messaging-topology-operator, secrets-store-csi-driver-provider-aws, smarter-device-manager, smokescreen, victoriametrics-cluster, aws-load-balancer-controller, malcontent, osv-scanner, nova...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: podman, prometheus, openbao, nats-top, kubernetes-csi-livenessprobe, manifest-tool, helm-mapkubeapis, kubernetes-csi-driver-hostpath, conjur-cli, envconsul, kubewatch, mockery, contour, boring-registry, oras, stern, ip-masq-agent, lazygit,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: sealed-secrets-fips, commercial-expanso-edge, mariadb-operator, flux-image-automation-controller-fips, nfs-subdir-external-provisioner, flux-image-automation-controller, nova, flux-operator, aws-load-balancer-controller, aws-iam-authenticator, aws-privateca-issuer,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: sealed-secrets-fips, commercial-expanso-edge, mariadb-operator, flux-image-automation-controller-fips, nfs-subdir-external-provisioner, flux-image-automation-controller, nova, flux-operator, aws-load-balancer-controller, aws-iam-authenticator, aws-privateca-issuer,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler, chartmuseum, podman-fips, bom, buildah, mailpit, fuse-overlayfs-snapshotter, nats-server, commercial-chainloop-backend, apko-fips, tigera-operator, nsc-fips, buildah-fips, slsa-verifier, harbor-fips, syft, aws-flb-firehose-fips, gomplate,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: cluster-autoscaler, chartmuseum, podman-fips, bom, buildah, mailpit, fuse-overlayfs-snapshotter, nats-server, commercial-chainloop-backend, apko-fips, tigera-operator, nsc-fips, buildah-fips, slsa-verifier, harbor-fips, syft, aws-flb-firehose-fips, gomplate,...

The vulnerability of RabbitMQ message brokers, related to the disclosure of information through registration files, allows attackers to gain unauthorized access to protected information.

The vulnerability of the RabbitMQ messaging broker is related to the exposure of information through registration files. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CLEANSTART-2026-PI36812 Security fixes for CVE-2026-33186, ghsa-6v2p-p943-phr9, ghsa-c6gw-w398-hv78, ghsa-f6x5-jh6r-wrfv, ghsa-hcg3-p754-cr77, ghsa-j5w8-q4qc-rx2x, ghsa-qxp5-gw88-xv66, ghsa-v778-237x-gjrc, ghsa-vvgc-356p-c3xw applied in versions: 1.15.0-r1, 1.19.0-r0

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

ROOT-OS-ALPINE-318-CVE-2023-35789 CVE-2023-35789 in rootio-rabbitmq-c - Patched by Root

Root has patched CVE-2023-35789 in the rootio-rabbitmq-c package for Root:Alpine:3.18. Multiple fixed versions available...

BIT-RABBITMQ-C-2023-35789

An issue was discovered in the C AMQP client library aka rabbitmq-c through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line e.g., for amqp-publish or amqp-consume and are thus visible to local attackers by listing a process and its arguments...

MAL-2026-1831 Malicious code in rabbitmq-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5fd48bd646ad6b2f173f479170d732395513c048f0c0f6148205c0e1d08f864 The package rabbitmq-sdk was found to contain malicious code...

Malicious code in rabbitmq-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5fd48bd646ad6b2f173f479170d732395513c048f0c0f6148205c0e1d08f864 The package rabbitmq-sdk was found to contain malicious code...