Vmware Spring Advanced Message Queuing Protocol vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Vmware Spring Advanced Message Queuing Protocol: 2 record(s), with affected versions and fixes.
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol

CVE-2026-41714 Medium · 4.0 CWE-295 Jun 9, 2026

In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

CVE-2026-41701 Medium · 4.4 CWE-330 Jun 9, 2026

In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.