Spring Spring AMQP güvenlik açıkları (CVE)

Spring Spring AMQP için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

7 sonuç

6.5Orta

CVE-2026-59320 2 ay önce

In Spring AMQP the link credit never replenished on listener exception path

Spring Spring AMQP

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and…

6.8Orta

CVE-2026-59272 2 ay önce

Log4j2 AmqpAppender disables TLS hostname verification by default

Spring Spring AMQP

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP …

6.6Orta

CVE-2026-59275 2 ay önce

Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

Spring Spring AMQP

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 …

5.3Orta

CVE-2026-59271 2 ay önce

Admin password disclosed in BrokerNotAliveException message

Spring Spring AMQP

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

6.5Orta

CVE-2026-47860 2 ay önce

Unbounded decompression of attacker-supplied compressed message bodies

Spring Spring AMQP

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

4.0Orta

CVE-2026-41714 5 ay önce

In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

Spring Spring AMQP

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.…

4.4Orta

CVE-2026-41701 5 ay önce

In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

Spring Spring AMQP

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.