| CVE-2026-59320 |
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing…
|
6.5
Medium
|
Aug 27, 2026 |
| CVE-2026-59272 |
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is…
|
6.8
Medium
|
Aug 27, 2026 |
| CVE-2026-59275 |
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread —…
|
6.6
Medium
|
Aug 27, 2026 |
| CVE-2026-59271 |
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown…
|
5.3
Medium
|
Aug 27, 2026 |
| CVE-2026-47860 |
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the…
|
6.5
Medium
|
Aug 26, 2026 |
| CVE-2026-41714 |
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also…
|
4.0
Medium
|
Jun 9, 2026 |
| CVE-2026-41701 |
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to…
|
4.4
Medium
|
Jun 9, 2026 |
| CVE-2023-34050 |
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were…
|
5.0
Medium
|
Oct 19, 2023 |