Skip to content
OpenAdvisories

Package · Maven

org.springframework.amqp:spring-amqp

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 4.0
    CVE-2026-41714

    In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

    Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0…

    Spring Spring AMQP org.springframework.amqp:spring-amqp Maven
  • Medium 4.4
    CVE-2026-41701

    In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

    Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

    Spring Spring AMQP org.springframework.amqp:spring-amqp Maven
  • Medium 6.5
    CVE-2021-22095

    Deserialization of Untrusted Data in Spring AMQP

    In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message

    org.springframework.amqp:spring-amqp spring Ubuntu Maven
  • Medium 6.5
    CVE-2021-22097

    Deserialization of Untrusted Data in Spring AMQP

    In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.uti…

    org.springframework.amqp:spring-amqp Maven
  • Medium 5.9
    CVE-2018-11087

    TLS validation error

    Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.

    Pivotal Spring AMQP com.rabbitmq:amqp-client org.springframework.amqp:spring-amqp Maven
  • Critical 9.8
    CVE-2017-8045

    Deserialization of Untrusted Data in Spring AMQP

    In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code executio…

    org.springframework.amqp:spring-amqp Maven
  • Critical 9.8
    CVE-2016-2173 Public exploit

    Improper Input Validation in Spring AMQP

    org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.

    org.springframework.amqp:spring-amqp Maven