Spring AMQP vulnerabilities

Latest Spring AMQP CVEs

Newest publication first

1. CVE-2026-59320 In Spring AMQP the link credit never replenished on listener exception path

   Published 2026-08-27

   Medium·CVSS 6.5 EPSS 0.42%

   When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops del...

2. CVE-2026-59272 Log4j2 AmqpAppender disables TLS hostname verification by default

   Published 2026-08-27

   Medium·CVSS 6.8 EPSS 0.27%

   Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

3. CVE-2026-59275 Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

   Published 2026-08-27

   Medium·CVSS 4.9 EPSS 0.45%

   A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 an...

4. CVE-2026-59271 Admin password disclosed in BrokerNotAliveException message

   Published 2026-08-27

   Medium·CVSS 6.5 EPSS 0.32%

   When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

5. CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies

   Published 2026-08-26

   Medium·CVSS 6.5 EPSS 0.42%

   An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

6. CVE-2026-41714 In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

   Published 2026-06-09

   Medium·CVSS 4.0 EPSS 0.13%

   Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0...

7. CVE-2026-41701 In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

   Published 2026-06-09

   Medium·CVSS 4.4 EPSS 0.17%

   Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

8. CVE-2023-34050 Spring AMQP Deserialization Vulnerability

   Published 2023-10-19

   Medium·CVSS 4.3 EPSS 1.8%

   In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provid...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.