GitHub Advisoryadvisory · Maven

GHSA-p8qj-fj6r-w7q9 Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

MEDIUM Published 2026-06-10 Modified 2026-08-12 Official page ↗
Aliases
CVE-2026-41714
Ecosystem
Maven
Packages
org.springframework.amqp:spring-amqp
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-295
Reviewed
2026-08-12

Affected packages

• Maven org.springframework.amqp:spring-amqp: >= 4.0.0, < 4.0.4 → fixed in 4.0.4 • Maven org.springframework.amqp:spring-amqp: >= 3.2.0, < 3.2.11 → fixed in 3.2.11 • Maven org.springframework.amqp:spring-amqp: >= 3.1.0, <= 3.1.15 (no fix yet) • Maven org.springframework.amqp:spring-amqp: <= 2.4.17 (no fix yet)

Description

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Related

Alias · CVE (1)

  • CVE-2026-41714 Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References