GitHub Advisoryadvisory · Maven

GHSA-p5f7-rjhp-pxvc Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

MEDIUM Published 2026-06-10 Modified 2026-08-12 Official page ↗
Aliases
CVE-2026-41701
Ecosystem
Maven
Packages
org.springframework.amqp:spring-amqp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-330
Reviewed
2026-08-12

Affected packages

• Maven org.springframework.amqp:spring-amqp: >= 4.0.0, < 4.0.4 → fixed in 4.0.4 • Maven org.springframework.amqp:spring-amqp: >= 3.2.0, < 3.2.11 → fixed in 3.2.11 • Maven org.springframework.amqp:spring-amqp: >= 3.1.0, <= 3.1.15 (no fix yet) • Maven org.springframework.amqp:spring-amqp: <= 2.4.17 (no fix yet)

Description

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Related

Alias · CVE (1)

  • CVE-2026-41701 Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple… vulnerability

Weakness · CWE (1)

  • CWE-330 Use of Insufficiently Random Values weakness

References