Skip to content
OpenAdvisories
Medium · 4.4 CVE-2026-41701 EUVD-2026-35895GHSA-p5f7-rjhp-pxvc

In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

Published Jun 9, 2026 · Updated Jun 23, 2026 · Assigned by vmware

Vendor: Spring Product: Spring AMQP Package: org.springframework.amqp:spring-amqp Ecosystem: Maven

Description

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.

Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Affected products

VendorProductAffectedFixed
Spring Spring AMQP 4.0.0 – < 4.0.3.1, 3.2.0 – < 3.2.10.1, 3.1.0 – < 3.1.16, 2.4.0 – < 2.4.18 4.0.3.1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.springframework.amqp:spring-amqp >= 4.0.0, < 4.0.4 4.0.4 GHSA-p5f7-rjhp-pxvc
Maven org.springframework.amqp:spring-amqp >= 3.2.0, < 3.2.11 3.2.11 GHSA-p5f7-rjhp-pxvc
Maven org.springframework.amqp:spring-amqp >= 3.1.0, <= 3.1.15 — GHSA-p5f7-rjhp-pxvc
Maven org.springframework.amqp:spring-amqp <= 2.4.17 — GHSA-p5f7-rjhp-pxvc

References