What’s Vulnerable › Products

Spring AMQP vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Spring AMQP version is affected

Latest Spring AMQP vulnerabilities

• CVE-2026-59320 — In Spring AMQP the link credit never replenished on listener exception path (CVSS 6.5)
• CVE-2026-59272 — Log4j2 AmqpAppender disables TLS hostname verification by default (CVSS 6.8)
• CVE-2026-59275 — Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99) (CVSS 4.9)
• CVE-2026-59271 — Admin password disclosed in BrokerNotAliveException message (CVSS 6.5)
• CVE-2026-47860 — Unbounded decompression of attacker-supplied compressed message bodies (CVSS 6.5)
• CVE-2026-41714 — In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager (CVSS 4.0)
• CVE-2026-41701 — In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues (CVSS 4.4)
• CVE-2023-34050 — Spring AMQP Deserialization Vulnerability (CVSS 4.3)
• CVE-2021-22095 — (CVSS 6.5)
• CVE-2021-22097 — (CVSS 6.5)
• CVE-2016-2173 — (CVSS 9.8)