Skip to content
OpenAdvisories

Product · Spring

Spring AMQP

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-59320

    In Spring AMQP the link credit never replenished on listener exception path

    When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and…

    Spring Spring AMQP
  • Medium 6.8
    CVE-2026-59272

    Log4j2 AmqpAppender disables TLS hostname verification by default

    Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP …

    Spring Spring AMQP
  • Medium 6.6
    CVE-2026-59275

    Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

    A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 …

    Spring Spring AMQP
  • Medium 5.3
    CVE-2026-59271

    Admin password disclosed in BrokerNotAliveException message

    When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

    Spring Spring AMQP
  • Medium 6.5
    CVE-2026-47860

    Unbounded decompression of attacker-supplied compressed message bodies

    An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earl…

    Spring Spring AMQP
  • Medium 4.0
    CVE-2026-41714

    In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

    Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0…

    Spring Spring AMQP org.springframework.amqp:spring-amqp Maven
  • Medium 4.4
    CVE-2026-41701

    In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

    Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

    Spring Spring AMQP org.springframework.amqp:spring-amqp Maven
  • Medium 5.0
    CVE-2023-34050 Public exploit

    Spring AMQP Deserialization Vulnerability

    In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no al…

    Spring Spring AMQP