4.4Orta
CVE-2026-41701In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Açıklama
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Zayıflık türü (CWE):
CWE-330
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Spring | Spring AMQP | 4.0.0 – < 4.0.3.1, 3.2.0 – < 3.2.10.1, 3.1.0 – < 3.1.16, 2.4.0 – < 2.4.18 | |
| vmware | spring advanced message queuing protocol | < 2.4.18 |
Kaynaklar ve yamalar
- https://spring.io/security/cve-2026-41701 Vendor Advisory
CPE eşleşmeleri (NVD) (4)
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*< 2.4.18cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 3.1.0 < 3.1.16cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.10.1cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.3.1