CVE-2026-41714: Spring AMQP Core - Missing Certificate and Hostname Verification in RabbitConnectionFactoryBean
Summary
CVE-2026-41714: Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verificatio... Affects org.springframework.amqp:spring-amqp across 4 version ranges.
< 2.4.17
>= 3.1.0, <= 3.1.15
>= 3.2.0, < 3.2.11
>= 4.0.0, < 4.0.4
Fixed in 2.4.17, 3.2.11 or 4.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring AMQP is a framework that provides support for AMQP-based messaging systems. It allows developers to build applications that communicate with message brokers like RabbitMQ. The framework simplifies the integration of messaging into Java applications, offering features like message conversion, listener containers, and transaction management. However, certain configurations can lead to vulnerabilities, particularly concerning secure connections.
Vulnerability Detail
The vulnerability arises from the configuration of the RabbitConnectionFactoryBean when using amqps URIs. If developers set the URI without enabling SSL certificate validation (setUseSSL(true)), the application can establish a TLS-encrypted connection without verifying the authenticity of the server's certificate or its hostname. This oversight can expose applications to man-in-the-middle attacks, where an attacker could intercept or alter messages between the application and the broker.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.172.4.17 -
>= 3.2.0, < 3.2.113.2.11 -
>= 4.0.0, < 4.0.44.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, if you cannot upgrade to a patched version immediately, ensure that you explicitly set setUseSSL(true) in your RabbitConnectionFactoryBean configuration. This will enable SSL but note that it does not fully mitigate the risk if the underlying library is vulnerable.
Conclusion
CVE-2026-41714 highlights a critical configuration oversight in Spring AMQP that can lead to significant security risks. It is essential for developers to ensure proper SSL configurations to protect their applications from potential attacks. Regular updates and monitoring for vulnerabilities are crucial for maintaining application security.
See every vulnerability recorded for org.springframework.amqp:spring-amqp →
FAQ
CVE-2026-41714 is a vulnerability in Spring AMQP that allows for TLS encryption without certificate validation, potentially exposing applications to man-in-the-middle attacks.
Affected versions include Spring AMQP 4.0.0 through 4.0.3, 3.2.0 through 3.2.10, 3.1.0 through 3.1.15, and 2.4.0 through 2.4.17.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring access to the code.
The CVSS score for this vulnerability is 4.0, indicating a moderate severity level.
If an immediate upgrade is not possible, ensure that you set setUseSSL(true) in your RabbitConnectionFactoryBean configuration as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.amqp:spring-amqp.
