CVE-2026-41714
published 2026-06-10CVE-2026-41714: Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS…
PriorityP418medium4CVSS 3.1
AVNACHPRNUINSCCLINAN
EPSS
0.13%
3.1th percentile
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_amqp | >= 2.4.0 < 2.4.18 | 2.4.18 |
| spring | spring_amqp | >= 3.1.0 < 3.1.16 | 3.1.16 |
| spring | spring_amqp | >= 3.2.0 < 3.2.10.1 | 3.2.10.1 |
| spring | spring_amqp | >= 4.0.0 < 4.0.3.1 | 4.0.3.1 |
| vmware | spring_advanced_message_queuing_protocol | < 2.4.18 | 2.4.18 |
| vmware | spring_advanced_message_queuing_protocol | >= 3.1.0 < 3.1.16 | 3.1.16 |
| vmware | spring_advanced_message_queuing_protocol | >= 3.2.0 < 3.2.10.1 | 3.2.10.1 |
| vmware | spring_advanced_message_queuing_protocol | >= 4.0.0 < 4.0.3.1 | 4.0.3.1 |
CVSS provenance
nvdv3.14.0MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no
ghsa_unreviewed·2026-06-10
CVE-2026-41714 [MEDIUM] CWE-295 Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
GHSA
Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean
ghsa·2026-06-10
CVE-2026-41714 [MEDIUM] CWE-295 Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean
Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Red Hat
spring-amqp: Spring AMQP: Lack of certificate validation in TLS connections
vendor_redhat·2026-06-09·CVSS 4.0
CVE-2026-41714 [MEDIUM] CWE-295 spring-amqp: Spring AMQP: Lack of certificate validation in TLS connections
spring-amqp: Spring AMQP: Lack of certificate validation in TLS connections
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
A flaw was found in Spring AMQP. Applications that configure their broker connection using `RabbitConnectionFactoryBean.setUri("amqps://...")` without explicitly enabling SSL via `setUseSSL(true)` may establish a TLS (Transport Layer Security) encrypted connection without proper certificate validation or hostname verification. This oversight could allow a remote attacker to inte
No detection rules found.
No public exploits indexed.
2026-06-10
Published