TLS Configuration Issue in Spring AMQP by Pivotal
CVE-2026-41714

4MEDIUM

Key Information:

Vendor

Spring

Status
Spring AMQp
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41714?

This vulnerability occurs in Spring AMQP when the broker connection is configured using RabbitConnectionFactoryBean.setUri("amqps://...") without enabling proper certificate validation and hostname verification by calling setUseSSL(true). As a result, applications may establish TLS connections that are susceptible to man-in-the-middle attacks, jeopardizing the integrity of transmitted data. Affected versions span multiple iterations of Spring AMQP, and users are advised to review their configuration settings to ensure secure connections.

Affected Version(s)

Spring AMQP 4.0.0 < 4.0.3.1

Spring AMQP 3.2.0 < 3.2.10.1

Spring AMQP 3.1.0 < 3.1.16

References

https://spring.io/security/cve-2026-41714

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.