CVE-2026-40971: Spring Boot RabbitMQ auto-configuration improper certificate validation
Spring Boot's RabbitMQ auto-configuration skips hostname verification when an SSL bundle is used to connect to the broker, a weakness classified as CWE-295. The NVD score is 9.1 (critical), while the vendor-associated scores in the record are 5, and the vendor advisory lists fixes in 4.0.6 and 3.5.14. No confirmed exploitation appears in the sources consulted.
Overview
Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when it is set up to use an SSL bundle to connect to the RabbitMQ broker. The weakness is classified as CWE-295 (Improper Certificate Validation). The vendor advisory is the primary source for the affected ranges and fixed versions.
Impact
When hostname verification is skipped, a client may accept a certificate that is valid but was not issued for the broker it is contacting. Based on the CWE classification, this can weaken the protection TLS normally provides against impersonation of the broker. The NVD assessment rates the issue as critical with a CVSS score of 9.1, while the vendor-associated scores in the record are 5. How much these scores apply to a given deployment depends on network exposure, which the record does not describe.
Affected products and versions
- Spring Boot from 4.0.0 up to and including 4.0.5, fixed in 4.0.6.
- Spring Boot from 3.5.0 up to and including 3.5.13, fixed in 3.5.14.
The record lists two product entries (Spring Spring Boot and Vmware Spring Boot) with the same ranges. The fixes field in the record is empty, so the fixed versions are taken from the description, which attributes them to the vendor advisory.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00301 with a percentile of 0.21732, and the SSVC exploitation value is none.
Remediation and mitigation
- Upgrade Spring Boot to 4.0.6 or 3.5.14, depending on the release line in use, as described in the vendor advisory.
- If an immediate upgrade is not possible, review where SSL bundles are used for RabbitMQ connections and limit those connections to trusted network paths.
- After upgrading, confirm that the configuration still meets your organization's certificate validation requirements.
Detection guidance
- Inventory applications that depend on Spring Boot and identify those that use RabbitMQ auto-configuration with an SSL bundle.
- Review build manifests and deployed artifacts for Spring Boot versions within the affected ranges.
- Monitor the messaging infrastructure for unexpected changes to broker endpoints or certificates.
Limitations of the available information
The record does not describe the exact code path, any additional conditions beyond the SSL bundle configuration, or whether exploitation is practical in real deployments. The record does not include a fixed-version field, so the fixed versions rely on the description text. The sources consulted provide no further details on other release lines.
Frequently asked questions
What is the core weakness in CVE-2026-40971?
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the broker. The weakness is classified as CWE-295.
Which versions are affected and what are the fixes?
The record describes Spring Boot from 4.0.0 up to and including 4.0.5, fixed in 4.0.6, and from 3.5.0 up to and including 3.5.13, fixed in 3.5.14, according to the vendor advisory.
Is this vulnerability known to be exploited?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.