CVE-2026-59272: Log4j2 AmqpAppender disables TLS hostname verification by default

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-27 · updated 2026-09-01
Weakness: CWE-297

Description

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Affected products

Spring AMQP: before 2.4.19; from 3.2.0 before 3.2.13; from 4.0.0 before 4.0.4.1; from 4.1.0 before 4.1.0.1 — fixed in 2.4.19, 3.2.13, 4.0.4.1, 4.1.0.1
Spring AMQP: from 4.0.0 through 4.0.4; from 3.2.0 through 3.2.12; through 2.4.18; 4.1.0

How to fix

Upgrade to a fixed version: Spring AMQP 2.4.19, 3.2.13, 4.0.4.1, 4.1.0.1. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-59272

Get alerted when CVE-2026-59272 or the next vulnerability affects your stack