SB20260828163 - Multiple vulnerabilities in Spring AMQP

Description

This security bulletin contains information about 5 vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2026-47860)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in message decompression when processing attacker-supplied compressed message bodies. A remote user can publish a specially crafted compressed message to cause a denial of service.

Only applications that have enabled message decompression are vulnerable. A single poison message may cause the service to crash-loop because it is redelivered after restart.

2) Improper Certificate Validation (CVE-ID: CVE-2026-59272)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to read or alter log traffic.

The vulnerability exists due to improper certificate validation in the Log4j2 AmqpAppender when shipping logs to RabbitMQ over TLS. A remote user can perform a man-in-the-middle attack on the network path to read or alter log traffic.

The issue affects deployments relying on the documented default behavior for hostname verification.

3) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-59271)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log or exception messages in the BrokerNotAliveException message when the RabbitMQ management aliveness check fails. A remote user can trigger the check failure to disclose sensitive information.

This occurs when a real credential is supplied through RABBITMQ_TEST_ADMIN_PASSWORD and test output or CI logs are accessible for reading.

4) Input validation error (CVE-ID: CVE-2026-59275)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to terminate the consumer JVM.

The vulnerability exists due to improper input validation in Java deserialization handling when processing a hostile AMQP message containing nested arrays. A remote privileged user can send a specially crafted AMQP message to terminate the consumer JVM.

The default JavaLangErrorHandler invokes System.exit(99) after the resulting StackOverflowError, causing full availability loss for workloads co-located in the same process.

5) Improper Resource Shutdown or Release (CVE-ID: CVE-2026-59320)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper resource management in the listener container link credit handling when processing message deliveries that trigger exceptions while a container-level ErrorHandler is configured. A remote user can send messages that repeatedly cause listener processing failures to cause a denial of service.

Only deployments with a container-level ErrorHandler configured are vulnerable, and the listener may remain reported as running after message delivery has stalled.

Remediation

Install update from vendor's website.

References

• https://spring.io/security/cve-2026-47860
• https://spring.io/security/cve-2026-59272
• https://spring.io/security/cve-2026-59271
• https://spring.io/security/cve-2026-59275
• https://spring.io/security/cve-2026-59320