CVE-2026-41701
published 2026-06-10CVE-2026-41701: Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected…
PriorityP421medium4.4CVSS 3.1
AVNACHPRHUINSCCLILAN
EPSS
0.17%
6.7th percentile
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_amqp | >= 2.4.0 < 2.4.18 | 2.4.18 |
| spring | spring_amqp | >= 3.1.0 < 3.1.16 | 3.1.16 |
| spring | spring_amqp | >= 3.2.0 < 3.2.10.1 | 3.2.10.1 |
| spring | spring_amqp | >= 4.0.0 < 4.0.3.1 | 4.0.3.1 |
| vmware | spring_advanced_message_queuing_protocol | < 2.4.18 | 2.4.18 |
| vmware | spring_advanced_message_queuing_protocol | >= 3.1.0 < 3.1.16 | 3.1.16 |
| vmware | spring_advanced_message_queuing_protocol | >= 3.2.0 < 3.2.10.1 | 3.2.10.1 |
| vmware | spring_advanced_message_queuing_protocol | >= 4.0.0 < 4.0.3.1 | 4.0.3.1 |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
vendor_redhat4.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Vmware Spring AMQP up to 2.4.17/3.1.15/3.2.10/4.0.3 RabbitTemplate.sendAndReceive random values (CNNVD-202606-2869)
vuldb·2026-06-11·CVSS 4.4
CVE-2026-41701 [MEDIUM] Vmware Spring AMQP up to 2.4.17/3.1.15/3.2.10/4.0.3 RabbitTemplate.sendAndReceive random values (CNNVD-202606-2869)
A vulnerability categorized as problematic has been discovered in Vmware Spring AMQP up to 2.4.17/3.1.15/3.2.10/4.0.3. The impacted element is the function RabbitTemplate.sendAndReceive. The manipulation results in insufficiently random values.
This vulnerability is cataloged as CVE-2026-41701. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
ghsa_unreviewed·2026-06-10
CVE-2026-41701 [MEDIUM] CWE-330 Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
GHSA
Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue
ghsa·2026-06-10
CVE-2026-41701 [MEDIUM] CWE-330 Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue
Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Red Hat
Spring AMQP: Spring AMQP: Predictable correlation IDs may lead to information disclosure
vendor_redhat·2026-06-09·CVSS 4.4
CVE-2026-41701 [MEDIUM] CWE-342 Spring AMQP: Spring AMQP: Predictable correlation IDs may lead to information disclosure
Spring AMQP: Spring AMQP: Predictable correlation IDs may lead to information disclosure
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
A flaw was found in Spring AMQP. The system generates predictable correlation identifiers (IDs) for message replies due to an internal simple counter. This predictability could allow an attacker to potentially infer or manipulate message flows, leading to a low impact on the confidentiality and integrity of data.
Statement: Red Hat products that bundle Spring AMQP are affected by this flaw. However, exploitation requires the application to use
No detection rules found.
No public exploits indexed.
2026-06-10
Published