Spring Amqp (Spring) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2026-08-27. Vendor: Spring.

CVEs of Spring Amqp

• CVE-2026-59320 - CVSS 6.5 (medium), 2026-08-27: When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one…
• CVE-2026-59272 - CVSS 6.8 (medium), 2026-08-27: Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of…
• CVE-2026-59275 - CVSS 6.6 (medium), 2026-08-27: A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every…
• CVE-2026-59271 - CVSS 6.5 (medium), 2026-08-27: When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0…
• CVE-2026-47860 - CVSS 6.5 (medium), 2026-08-26: An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB…
• CVE-2026-41701 - CVSS 4.4 (medium), 2026-06-10: Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected…
• CVE-2026-41714 - CVSS 4 (medium), 2026-06-10: Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS…
• CVE-2023-34050 - CVSS 5 (medium), 2023-10-19: In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to…