br.jus.stf.digital:core (>=2.0.0, <=2.3.1), com.ecfront.dew:logger (>=1.1.0, <=1.1.4) +78 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.1.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - br.jus.stf.digital:core =2.0.0, =1.1.0, =1.1.0, =1.0.2-release, =1.0.5-release,...

cc.voox:publisher (0.1.2.ga), org.springframework.amqp:spring-rabbit (1.2.2.release) +2 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.2.2.release)

org.springframework.amqp:spring-amqp MAVEN version 1.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - cc.voox:publisher 0.1.2.ga - org.springframework.amqp:spring-rabbit 1.2.2.relea...

com.ahome-it:ahome-tooling-server-core (1.1.0-release), com.ahome-it:ahome-tooling-server-hazelcast (1.1.0-release) +151 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.5.6.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.ahome-it:ahome-tooling-server-core 1.1.0-release -...

org.springframework.amqp:spring-rabbit (1.4.6.release), org.springframework.boot:spring-boot-starter-amqp (>=1.2.7.release, <=1.2.8.release) +5 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.4.6.release)

org.springframework.amqp:spring-amqp MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.4.6.release -...

com.ahome-it:ahome-tooling-server-core (>=1.1.14-release, <=1.1.18-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.14-release, <=1.1.17-release) +6 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.6.3.release)

org.springframework.amqp:spring-amqp MAVEN version 1.6.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.14-release, =1.1.14-release,...

org.springframework.amqp:spring-rabbit (1.5.1.release), org.springframework.integration:spring-integration-amqp (4.2.1.release) potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.5.1.release)

org.springframework.amqp:spring-amqp MAVEN version 1.5.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.5.1.release -...

io.zipkin.brave:brave-instrumentation-spring-rabbit (>=5.1.4, <=5.4.2), org.springframework.amqp:spring-rabbit (1.7.9.release) +2 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.9.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - io.zipkin.brave:brave-instrumentation-spring-rabbit =5.1.4, =5.4.2 -...

org.springframework.amqp:spring-rabbit (1.7.15.release), org.springframework.amqp:spring-rabbit-test (1.7.15.release) potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (1.7.15.release)

org.springframework.amqp:spring-amqp MAVEN version 1.7.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.7.15.release -...

Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

EUVD-2026-35895

Correlation IDs for replies in the RabbitTemplate.sendAndReceive with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17...

cn.structured:structure-audit-application (v2.0.0), cn.structured:structure-audit-infra (v2.0.0) +98 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=4.0.0, <=4.0.3)

org.springframework.amqp:spring-amqp MAVEN version =4.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.0, =2.0.1 and more Source cves: CVE-2026-41701 Source advisory: GHSA-P5F7-RJHP-PXVC...

cloud.wondrify:grails-rabbit-amqp-plugin (7.0.0), cn.hiapi:hiapi-core-application (1.0.8) +374 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=3.2.0, <=3.2.10)

org.springframework.amqp:spring-amqp MAVEN version =3.2.0, =2.0.1, =1.0.1-jdk21, =3.5.5, =3.5.0-jdk17-1.0.0, =0.7.0, =0.7.0, =0.2.0, =0.1.0-beta.1, =0.1.0 - com.buession.cas:cas-server-support-logging 4.0.0 and more Source cves: CVE-2026-41701 Source advisory: GHSA-P5F7-RJHP-PXVC...

cn.hdfk7.boot:hdfk7-boot-starter-common (>=1.0.0, <=3.0.3), cn.herodotus.engine:message-rabbitmq-spring-boot-starter (>=3.2.0.0, <=3.3.0.6) +279 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=3.1.0, <=3.1.12)

org.springframework.amqp:spring-amqp MAVEN version =3.1.0, =1.0.0, =3.2.0.0, =3.3.0.0, =5.0.7, =0.1.0, =0.1.0, =2.1.21, =0.12.2, =0.10.0, =5.13.0, =5.13.2 and more Source cves: CVE-2026-41701 Source advisory: GHSA-P5F7-RJHP-PXVC...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), br.com.itsme:commons (>=0.0.4-alpha, <=0.0.5-alpha) +944 more potentially affected by CVE-2026-41701 via org.springframework.amqp:spring-amqp (>=2.0.0.release, <=2.4.17)

org.springframework.amqp:spring-amqp MAVEN version =2.0.0.release, =0.5.0, =0.0.4-alpha, =0.1.0.beta, =3.0.0.release, =3.0.0.release, =1.0.0, =1.0.0, =1.2.0-release, =1.0.1, =1.0.0, =2.1.0 and more Source cves: CVE-2026-41701 Source advisory: GHSA-P5F7-RJHP-PXVC...

cn.dev8:ktmyoql (>=0.0.1, <=0.0.7), com.avides.springboot.testcontainer:springboot-testcontainer-mongodb (>=0.1.0-rc7, <=0.1.0-rc10) +25 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.4.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - cn.dev8:ktmyoql =0.0.1, =0.1.0-rc7, =1.0.4, =0.3.0, =0.28.0,...

cn.springcloud.gray:spring-cloud-gray-server (>=a.1.1.1, <=a.2.0.0), cn.springcloud.gray:spring-cloud-gray-server-cluster-http-synchro-plugin (>=a.2.0.0.rc1, <=a.2.0.0) +171 more potentially affected by CVE-2026-41711 via org.springframework.data:spring-data-commons (1.13.23.release)

org.springframework.data:spring-data-commons MAVEN version 1.13.23.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-commons and may be impacted: - cn.springcloud.gray:spring-cloud-gray-server =a.1.1.1,...

org.springframework.amqp:spring-rabbit (1.3.8.release) potentially affected by CVE-2026-41714 via org.springframework.amqp:spring-amqp (1.3.8.release)

org.springframework.amqp:spring-amqp MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.amqp:spring-amqp and may be impacted: - org.springframework.amqp:spring-rabbit 1.3.8.release Source cves: CVE-2026-4171...

CVE-2026-47838

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7....

CVE-2026-41731

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jackson's default bean deserialization, a producer could supply crafted...

CVE-2026-41730

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through...