Spring Spring Amqp
8 CVEs affecting Spring Spring Amqp. Latest disclosed: 2026-08-27. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-59272 | Medium | 6.8 | 2026-08-27 | Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of… |
CVE-2026-59275 | Medium | 6.6 | 2026-08-27 | A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload… |
CVE-2026-59320 | Medium | 6.5 | 2026-08-27 | When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one lin… |
CVE-2026-47860 | Medium | 6.5 | 2026-08-27 | An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message… |
CVE-2026-59271 | Medium | 5.3 | 2026-08-27 | When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 S… |
CVE-2023-34050 | Medium | 5.0 | 2023-10-19 | In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing… |
CVE-2026-41701 | Medium | 4.4 | 2026-06-10 | Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected version… |
CVE-2026-41714 | Medium | 4.0 | 2026-06-10 | Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encrypti… |