VMware Spring Advanced Message Queuing Protocol
10 CVEs affecting VMware Spring Advanced Message Queuing Protocol. Latest disclosed: 2026-08-27. Critical: 1, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-2173 | Critical | 9.8 | 2017-04-21 | org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code. |
CVE-2026-59272 | Medium | 6.8 | 2026-08-27 | Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of… |
CVE-2026-59275 | Medium | 6.6 | 2026-08-27 | A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload… |
CVE-2026-59320 | Medium | 6.5 | 2026-08-27 | When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one lin… |
CVE-2026-47860 | Medium | 6.5 | 2026-08-27 | An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message… |
CVE-2021-22095 | Medium | 6.5 | 2021-11-30 | In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the m… |
CVE-2021-22097 | Medium | 6.5 | 2021-10-28 | In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with… |
CVE-2026-59271 | Medium | 5.3 | 2026-08-27 | When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 S… |
CVE-2023-34050 | Medium | 5.0 | 2023-10-19 | In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing… |
CVE-2026-41714 | Medium | 4.0 | 2026-06-10 | Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encrypti… |