CVE-2018-11087: TLS validation error

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-14 · updated 2026-06-17
Weakness: CWE-295

Description

Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.

Affected products

Spring AMQP Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7: from 1.0.0 before 1.7.10; from 2.0.0 before 2.0.6 — fixed in 1.7.10, 2.0.6
rabbitmq-java-client: before 4.8.0; from 4.8.1 before 5.4.0 — fixed in 4.8.0, 5.4.0
Pivotal Spring AMQP: from 1.x before 1.7.10; from 2.x before 2.0.6 — fixed in 1.7.10, 2.0.6

How to fix

Upgrade to a fixed version: Spring AMQP Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7 1.7.10, 2.0.6; rabbitmq-java-client 4.8.0, 5.4.0; Pivotal Spring AMQP 1.7.10, 2.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-11087 or the next vulnerability affects your stack