4.4Medium
CVE-2026-41701In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Description
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Weakness (CWE):
CWE-330
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| Spring | Spring AMQP | 4.0.0 – < 4.0.3.1, 3.2.0 – < 3.2.10.1, 3.1.0 – < 3.1.16, 2.4.0 – < 2.4.18 | |
| vmware | spring advanced message queuing protocol | < 2.4.18 |
References and patches
- https://spring.io/security/cve-2026-41701 Vendor Advisory
CPE matches (NVD) (4)
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*< 2.4.18cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 3.1.0 < 3.1.16cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.10.1cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.3.1