SA
Product
Spring AMQP
7
CVEs
0
On KEV
6.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 7Low 0
Watch
Add Spring AMQP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59272 | 6.8 | Aug 27 | Log4j2 AmqpAppender disables TLS hostname verification by default Affected: 4.1.0; 4.0.0 through 4.0.4; 3.2.0 through 3.2.12; through 2.4.18 |
| CVE-2026-59320 | 6.5 | Aug 27 | In Spring AMQP the link credit never replenished on listener exception path Affected: 4.1.0 |
| CVE-2026-59271 | 6.5 | Aug 27 | Admin password disclosed in BrokerNotAliveException message Affected: 4.1.0; 4.0.0 through 4.0.4; 3.2.0 through 3.2.12; through 2.4.18 |
| CVE-2026-47860 | 6.5 | Aug 26 | Unbounded decompression of attacker-supplied compressed message bodies Affected: 4.1.0; 4.0.0 through 4.0.4; 3.2.0 through 3.2.12; through 2.4.18 |
| CVE-2026-59275 | 4.9 | Aug 27 | Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99) Affected: 4.1.0; 4.0.0 through 4.0.4; 3.2.0 through 3.2.12; through 2.4.18 |
| CVE-2026-41701 | 4.4 | Jun 9 | In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues Affected: 4.0.0 before 4.0.3.1; 3.2.0 before 3.2.10.1; 3.1.0 before 3.1.16; 2.4.0 before 2.4.18 |
| CVE-2026-41714 | 4.0 | Jun 9 | In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager Affected: 4.0.0 before 4.0.3.1; 3.2.0 before 3.2.10.1; 3.1.0 before 3.1.16; 2.4.0 before 2.4.18 |
Showing 7