Spring Spring AMQP vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20267

Newest CVEs

• CVE-2026-59320

  In Spring AMQP the link credit never replenished on listener exception path

  Spring · Spring AMQP

  Medium6.5
• CVE-2026-59272

  Log4j2 AmqpAppender disables TLS hostname verification by default

  Spring · Spring AMQP

  Medium6.8
• CVE-2026-59275

  Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

  Spring · Spring AMQP

  Medium6.6
• CVE-2026-59271

  Admin password disclosed in BrokerNotAliveException message

  Spring · Spring AMQP

  Medium5.3
• CVE-2026-47860

  Unbounded decompression of attacker-supplied compressed message bodies

  Spring · Spring AMQP

  Medium6.5
• CVE-2026-41714

  In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

  Spring · Spring AMQP

  Medium4.0
• CVE-2026-41701

  In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

  Spring · Spring AMQP

  Medium4.4
• CVE-2023-34050

  Spring AMQP Deserialization Vulnerability

  Spring · Spring AMQP

  Medium5.0