SB20260828157 - Multiple vulnerabilities in Spring AMQP

Description

This security bulletin contains information about 2 vulnerabilities.

1) Generation of Predictable Numbers or Identifiers (CVE-ID: CVE-2026-41701)

CWE-ID: CWE-340 - Generation of Predictable Numbers or Identifiers

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to inject spoofed replies and disclose sensitive information.

The vulnerability exists due to improper generation of predictable identifiers in RabbitTemplate.sendAndReceive() with the fixed reply queue when processing reply correlation IDs. A remote privileged user can send a crafted reply with a predicted correlation ID to inject spoofed replies and disclose sensitive information.

2) Improper Certificate Validation (CVE-ID: CVE-2026-41714)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper certificate validation in RabbitConnectionFactoryBean.setUri("amqps://...") when configuring broker connections with amqps without also calling setUseSSL(true). A remote attacker can present a crafted TLS endpoint to disclose sensitive information.

Hostname verification is also not performed in this configuration.

Remediation

Install update from vendor's website.

References

• https://spring.io/security/cve-2026-41701
• https://spring.io/security/cve-2026-41714