CVE-2026-41701
published 2026-06-10CVE-2026-41701: Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected…
PriorityP421medium4.4CVSS 3.1
AVNACHPRHUINSCCLILAN
EPSS
0.17%
6.9th percentile
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_amqp | >= 2.4.0 < 2.4.18 | 2.4.18 |
| spring | spring_amqp | >= 3.1.0 < 3.1.16 | 3.1.16 |
| spring | spring_amqp | >= 3.2.0 < 3.2.10.1 | 3.2.10.1 |
| spring | spring_amqp | >= 4.0.0 < 4.0.3.1 | 4.0.3.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Vmware Spring AMQP up to 2.4.17/3.1.15/3.2.10/4.0.3 RabbitTemplate.sendAndReceive random values (CNNVD-202606-2869)
vuldb·2026-06-11·CVSS 4.4
CVE-2026-41701 [MEDIUM] Vmware Spring AMQP up to 2.4.17/3.1.15/3.2.10/4.0.3 RabbitTemplate.sendAndReceive random values (CNNVD-202606-2869)
A vulnerability categorized as problematic has been discovered in Vmware Spring AMQP up to 2.4.17/3.1.15/3.2.10/4.0.3. The impacted element is the function RabbitTemplate.sendAndReceive. The manipulation results in insufficiently random values.
This vulnerability is cataloged as CVE-2026-41701. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
ghsa_unreviewed·2026-06-10
CVE-2026-41701 [MEDIUM] CWE-330 Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-10
Published