4.4
Moyenne
CVE-2026-41701 Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to…
Description
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring AMQP 4.0 | 4.0.0 → < 4.0.3.1 | 4.0.3.1 |
| Spring AMQP 3.2 | 3.2.0 → < 3.2.10.1 | 3.2.10.1 |
| Spring AMQP 3.1 | 3.1.0 → < 3.1.16 | 3.1.16 |
| Spring AMQP 2.4 | 2.4.0 → < 2.4.18 | 2.4.18 |
Références
- spring.io spring.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring AMQP
Les 8 CVE de Spring AMQP →
CVE-2026-59320
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing…
6.5
Moyenne
CVE-2026-59272
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is…
6.8
Moyenne
CVE-2026-59275
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread —…
6.6
Moyenne
CVE-2026-59271
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown…
5.3
Moyenne