6.8Mittel
CVE-2026-59272Log4j2 AmqpAppender disables TLS hostname verification by default
Beschreibung
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Schwachstellentyp (CWE):
CWE-297
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Spring | Spring AMQP | 4.1.0, 4.0.0 – ≤ 4.0.4, 3.2.0 – ≤ 3.2.12, ≤ 2.4.18 | |
| vmware | spring advanced message queuing protocol | < 2.4.19 |
Referenzen und Patches
- https://spring.io/security/cve-2026-59272 Vendor Advisory
CPE-Treffer (NVD) (4)
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*< 2.4.19cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.13cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.4.1cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.0.1