medium4.0
CVE-2026-41714
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encrypti…
Impact
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.amqp:spring-amqp | >= 4.0.0, <= 4.0.3 | 4.0.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Advanced Message Queuing Protocol | before 2.4.18 from 3.1.0 before 3.1.16 from 3.2.0 before 3.2.10.1 from 4.0.0 before 4.0.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-p8qj-fj6r-w7q9
- https://nvd.nist.gov/vuln/detail/CVE-2026-41714
- https://spring.io/security/cve-2026-41714
- https://github.com/spring-projects/spring-amqp/releases/tag/v3.2.11
- https://github.com/spring-projects/spring-amqp/releases/tag/v4.0.4