CVE-2026-41701: Spring AMQP Predictable Correlation IDs in RabbitTemplate.sendAndReceive()
Summary
CVE-2026-41701: Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue. Affects org.springframework.amqp:spring-amqp across 4 version ranges.
< 2.4.17
>= 3.1.0, <= 3.1.15
>= 3.2.0, < 3.2.11
>= 4.0.0, < 4.0.4
Fixed in 2.4.17, 3.2.11 or 4.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring AMQP is a framework that provides support for AMQP-based messaging solutions, allowing developers to easily integrate messaging capabilities into their applications. It is widely used for building applications that require reliable messaging and asynchronous processing. The framework includes features such as message conversion, error handling, and transaction management. However, certain versions of Spring AMQP are vulnerable to a flaw that makes correlation IDs predictable, which can lead to security issues in message handling.
Vulnerability Detail
The vulnerability arises from the use of a simple internal counter to generate correlation IDs for replies in the RabbitTemplate.sendAndReceive() method when using a fixed reply queue. This predictability allows an attacker to potentially guess the correlation IDs, leading to unauthorized access to message replies. The affected versions include Spring AMQP 4.0.0 through 4.0.3, 3.2.0 through 3.2.10, 3.1.0 through 3.1.15, and 2.4.0 through 2.4.17. The ramifications of this vulnerability can include data leakage and unauthorized message manipulation, posing a moderate security risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.172.4.17 -
>= 3.2.0, < 3.2.113.2.11 -
>= 4.0.0, < 4.0.44.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing a custom correlation ID generation strategy to mitigate the risk. This could involve using a UUID or a secure random number generator instead of relying on the internal counter.
Conclusion
The vulnerability CVE-2026-41701 in Spring AMQP poses a moderate security risk due to predictable correlation IDs in message replies. It is crucial to update to a patched version to mitigate this risk. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your applications effectively.
See every vulnerability recorded for org.springframework.amqp:spring-amqp →
FAQ
CVE-2026-41701 is a vulnerability in Spring AMQP that allows for predictable correlation IDs in message replies, potentially leading to unauthorized access.
Affected versions include Spring AMQP 4.0.0 through 4.0.3, 3.2.0 through 3.2.10, 3.1.0 through 3.1.15, and 2.4.0 through 2.4.17.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just your pom.xml file. Visit Vulert Scanner to check your application without signup.
The CVSS score of this vulnerability is 4.4, indicating a moderate severity level.
If an immediate upgrade is not possible, consider implementing a custom correlation ID generation strategy to reduce the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.amqp:spring-amqp.
