Spring Amqp
Approved changes feed: RSS · Atom
cpe:2.3:a:spring:spring_amqp:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Spring (4c7a31af-cbd7-516f-b1ce-2d5f574797bc) |
|---|---|
| Product | Spring Amqp (459047cc-b6e9-5490-a02e-468f062ef415) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-41714 |
vulnerable | 2026-07-29 00:49:31.459557 |
In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager
MEDIUM (4)
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Published: 2026-06-09T23:48:16.317Z
Updated: 2026-06-27T21:14:02.581Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41701 |
vulnerable | 2026-07-29 00:49:31.450677 |
In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
MEDIUM (4.4)
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Published: 2026-06-09T23:47:54.996Z
Updated: 2026-06-23T20:48:22.061Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-34050 |
vulnerable | 2026-06-08 06:06:24.318181 |
Spring AMQP Deserialization Vulnerability
MEDIUM (5)
In spring AMQP versions 1.0.0 to
2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class
names were added to Spring AMQP, allowing users to lock down deserialization of
data in messages from untrusted sources; however by default, when no allowed
list was provided, all classes could be deserialized.
Specifically, an application is
vulnerable if
* the
SimpleMessageConverter or SerializerMessageConverter is used
* the user
does not configure allowed list patterns
* untrusted
message originators gain permissions to write messages to the RabbitMQ
broker to send malicious content
Published: 2023-10-19T07:11:35.038Z
Updated: 2024-09-12T17:58:46.718Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.