Improper Certificate Validation

Spring AMQP is vulnerable to Improper Certificate Validation. The vulnerability is due to TLS connections configured through RabbitConnectionFactoryBean.setUri"amqps://..." lacking certificate and hostname verification unless setUseSSLtrue is explicitly enabled, which allows an attacker to...

Insecure Randomness

Spring AMQP is vulnerable to Predictable Correlation Identifier vulnerability as per NVD Description or CWE-330. The vulnerability is due to correlation IDs for RabbitTemplate.sendAndReceive replies being generated using a predictable internal counter, which allows an attacker to predict...

CLSA-2026-1785380226 TuxCare security update for org.springframework.amqp (2 CVEs)

TuxCare rebuilt 4 org.springframework.amqp packages to address 2 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1...

CLSA-2026-1784769561 TuxCare security update for org.springframework.amqp (2 CVEs)

TuxCare rebuilt 7 org.springframework.amqp packages to address 2 CVEs. Fixed in 3.1.8-tuxcare.1...

CVE-2026-41714

A flaw was found in Spring AMQP. Applications that configure their broker connection using RabbitConnectionFactoryBean.setUri"amqps://..." without explicitly enabling SSL via setUseSSLtrue may establish a TLS Transport Layer Security encrypted connection without proper certificate validation or...

K000162395: Spring AMQP vulnerability CVE-2026-41701

Security Advisory Description Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

ROOT-APP-MAVEN-CVE-2026-41701 CVE-2026-41701 in io.root.org.springframework.amqp:spring-amqp - Patched by Root

Root has patched CVE-2026-41701 in the io.root.org.springframework.amqp:spring-amqp package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41714 CVE-2026-41714 in io.root.org.springframework.amqp:spring-amqp - Patched by Root

Root has patched CVE-2026-41714 in the io.root.org.springframework.amqp:spring-amqp package for Root:Maven. Multiple fixed versions available...

Improper Certificate Validation

Overview org.springframework.amqp:spring-amqp is a package that provides support for using Spring and Java with AMQP 0.9.1, and in particular RabbitMQ. Affected versions of this package are vulnerable to Improper Certificate Validation. in the RabbitConnectionFactoryBean.setUri function when...

Insecure Randomness

Overview Affected versions of this package are vulnerable to Insecure Randomness via the sendAndReceive function when using a fixed reply queue, due to correlation IDs being generated sequentially by an internal counter. An attacker can intercept or inject unauthorized replies by predicting...

Insecure Randomness

Overview org.springframework.amqp:spring-amqp is a package that provides support for using Spring and Java with AMQP 0.9.1, and in particular RabbitMQ. Affected versions of this package are vulnerable to Insecure Randomness. via the sendAndReceive function when using a fixed reply queue, due to...

EUVD-2026-35895

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

GHSA-P8QJ-FJ6R-W7Q9 Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....

Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....

Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

GHSA-P5F7-RJHP-PXVC Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

PT-2026-75996

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....

CVE-2026-41714: Improper Certificate Validation

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....

CVE-2026-41701: Use of Insufficiently Random Values

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

PT-2026-75993

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...