medium4.4
CVE-2026-41701
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Impact
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.amqp:spring-amqp | >= 4.0.0, <= 4.0.3 | 4.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Advanced Message Queuing Protocol | before 2.4.18 from 3.1.0 before 3.1.16 from 3.2.0 before 3.2.10.1 from 4.0.0 before 4.0.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-p5f7-rjhp-pxvc
- https://nvd.nist.gov/vuln/detail/CVE-2026-41701
- https://spring.io/security/cve-2026-41701
- https://github.com/spring-projects/spring-amqp/releases/tag/v3.2.11
- https://github.com/spring-projects/spring-amqp/releases/tag/v4.0.4