CVE-2026-47860

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

PT-2026-82544

Name of the Vulnerable Software and Affected Versions Spring AMQP version 4.1.0 Spring AMQP versions 4.0.0 through 4.0.4 Spring AMQP versions 3.2.0 through 3.2.12 Spring AMQP versions 2.4.18 and earlier Description Applications that send logs to RabbitMQ over TLS using the Log4j2 appender are...

PT-2026-82414

Name of the Vulnerable Software and Affected Versions Spring AMQP version 4.1.0 Spring AMQP versions 4.0.0 through 4.0.4 Spring AMQP versions 3.2.0 through 3.2.12 Spring AMQP versions 2.4.18 and earlier Description When the RabbitMQ management aliveness check fails, the configured admin password ...

CVE-2026-47860: Undefined Security Weakness

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

PT-2026-82416

Name of the Vulnerable Software and Affected Versions Spring AMQP version 4.1.0 Spring AMQP versions 4.0.0 through 4.0.4 Spring AMQP versions 3.2.0 through 3.2.12 Spring AMQP versions 2.4.18 and earlier Description A single hostile AMQP message can cause the entire consumer JVM to terminate via a...

PT-2026-82723

When a container-level ErrorHandler is configured the mitigation for finding 221000, each delivery whose processing throws still permanently consumes one link credit. After initialCredits default 100 failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the...

CVE-2026-59320: Missing Release of Resource after Effective Lifetime

When a container-level ErrorHandler is configured the mitigation for finding 221000, each delivery whose processing throws still permanently consumes one link credit. After initialCredits default 100 failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the...

CVE-2026-59275: Deserialization of Untrusted Data

A single hostile AMQP message can terminate the entire consumer JVM System.exit99, not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-59271: Generation of Error Message Containing Sensitive Information

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-59272: Improper Validation of Certificate with Host Mismatch

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-47860

CVE-2026-47860 affects Spring AMQP and stems from unbounded decompression of attacker-supplied compressed message bodies. An attacker with the ability to publish to a queue consumed by an application with message decompression enabled can crash the consumer JVM using a single message of approxima...

CVE-2026-47860

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

PT-2026-82354

Name of the Vulnerable Software and Affected Versions Spring AMQP version 4.1.0 Spring AMQP versions 4.0.0 through 4.0.4 Spring AMQP versions 3.2.0 through 3.2.12 Spring AMQP versions 2.4.18 and earlier Description An attacker capable of publishing to a queue consumed by an application with messa...

CVE-2026-59320

CVE-2026-59320...

Deserialization of Untrusted Data

Overview org.springframework.amqp:spring-amqp is a package that provides support for using Spring and Java with AMQP 0.9.1, and in particular RabbitMQ. Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the deserialization process. An attacker can cause...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the ErrorHandler process. An attacker can cause the listener to become unresponsive and halt message processing by repeatedly triggering exceptions during message delivery, which...

Allocation of Resources Without Limits or Throttling

Overview org.springframework.amqp:spring-amqp is a package that provides support for using Spring and Java with AMQP 0.9.1, and in particular RabbitMQ. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via message decompression. An attacker c...