CVE-2026-41701
In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
- Record
CVE-2026-41701- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
EUVDEUVD-2026-35895
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
- Record
EUVD-2026-35895- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p5f7-rjhp-pxvc
Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
- Record
GHSA-p5f7-rjhp-pxvc- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
NVD
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
- Record
CVE-2026-41701- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
OSV
In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
- Record
CVE-2026-41701- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
OSVGHSA-p5f7-rjhp-pxvc
Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
- Record
GHSA-p5f7-rjhp-pxvc- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-330
- Updated
- 2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1791361557 No score
TuxCare security update for org.springframework.amqp:spring-amqp (2 CVEs)
TuxCare rebuilt org.springframework.amqp:spring-amqp to address 2 CVEs. Fixed in 3.1.12-tuxcare.6.
- Record
CLSA-2026-1791361557- Updated
- 2026-11-02
OSVCLSA-2026-1792078191 No score
TuxCare security update for org.springframework.amqp (6 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 6 CVEs. Fixed in 3.1.11-tuxcare.1.
- Record
CLSA-2026-1792078191- Updated
- 2026-11-02
OSVCLSA-2026-1793728143 No score
TuxCare security update for org.springframework.amqp:spring-amqp (2 CVEs)
TuxCare rebuilt org.springframework.amqp:spring-amqp to address 2 CVEs. Fixed in 3.2.8-tuxcare.3.
- Record
CLSA-2026-1793728143- Updated
- 2026-11-04
OSVCLSA-2026-1793960081 No score
TuxCare security update for org.springframework.amqp:spring-amqp (1 CVE)
TuxCare rebuilt org.springframework.amqp:spring-amqp to address 1 CVE. Fixed in 3.1.8-tuxcare.8.
- Record
CLSA-2026-1793960081- Updated
- 2026-11-06
OSVROOT-APP-MAVEN-CVE-2026-41701 No score
CVE-2026-41701 in io.root.org.springframework.amqp:spring-amqp - Patched by Root
Root has patched CVE-2026-41701 in the io.root.org.springframework.amqp:spring-amqp package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-41701- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.amqp:spring-amqpMaven |
4.0.0 to 4.0.3 | 4.0.4 |
org.springframework.amqp:spring-amqpMaven |
3.2.0 to 3.2.10 | 3.2.11 |
org.springframework.amqp:spring-amqpMaven |
3.1.0 to 3.1.15 | None known |
org.springframework.amqp:spring-amqpMaven |
through 2.4.17 | None known |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 2 CVEs |
3.1.12 up to 3.1.12-tuxcare.6, plus listed versions 3.1.12-tuxcare.13.1.12-tuxcare.23.1.12-tuxcare.33.1.12-tuxcare.43.1.12-tuxcare.5 |
3.1.12-tuxcare.6 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 6 CVEs |
3.1.11 up to 3.1.11-tuxcare.1 | 3.1.11-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 6 CVEs |
3.1.11 up to 3.1.11-tuxcare.1 | 3.1.11-tuxcare.1 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 6 CVEs |
3.1.11 up to 3.1.11-tuxcare.1 | 3.1.11-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 2 CVEs |
3.2.8 up to 3.2.8-tuxcare.3, plus listed versions 3.2.8-tuxcare.13.2.8-tuxcare.2 |
3.2.8-tuxcare.3 |
org.springframework.amqp:spring-amqpTuxCare:Maven |
3.1.8 up to 3.1.8-tuxcare.8, plus listed versions 3.1.8-tuxcare.13.1.8-tuxcare.23.1.8-tuxcare.33.1.8-tuxcare.43.1.8-tuxcare.53.1.8-tuxcare.63.1.8-tuxcare.7 |
3.1.8-tuxcare.8 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.amqp:spring-amqpMaven |
4.0.0 up to 4.0.4, plus listed versions 4.0.14.0.24.0.3 |
4.0.4 |
org.springframework.amqp:spring-amqpMaven |
3.2.0 up to 3.2.11, plus listed versions 3.2.13.2.103.2.23.2.33.2.4 Show 5 moreShow less3.2.53.2.63.2.73.2.83.2.9 |
3.2.11 |
org.springframework.amqp:spring-amqpMaven |
3.1.0 to 3.1.15, plus listed versions 3.1.13.1.103.1.113.1.123.1.2 Show 7 moreShow less3.1.33.1.43.1.53.1.63.1.73.1.83.1.9 |
None known |
org.springframework.amqp:spring-amqpMaven |
through 2.4.17, plus listed versions 1.0.0.RELEASE1.1.0.RELEASE1.1.1.RELEASE1.1.2.RELEASE1.1.3.RELEASE Show 45 moreShow less1.1.4.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.3.9.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.2.RELEASE1.5.3.RELEASE1.5.4.RELEASE1.5.5.RELEASE1.5.6.RELEASE1.5.7.RELEASE1.6.0.RELEASE1.6.1.RELEASE1.6.10.RELEASE1.6.11.RELEASE1.6.2.RELEASE1.6.3.RELEASE1.6.4.RELEASE1.6.5.RELEASE1.6.6.RELEASE1.6.7.RELEASE1.6.8.RELEASE1.6.9.RELEASE1.7.0.RELEASE1.7.1.RELEASE1.7.10.RELEASE1.7.11.RELEASE |
None known |
io.root.org.springframework.amqp:spring-amqpRoot:Maven |
before 3.2.5-root.io.1 | 3.2.5-root.io.1 |
org.springframework.amqp:spring-amqpRoot:Maven |
before 3.2.5-aikido.1 | 3.2.5-aikido.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| affected, aliases, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41701 is a medium vulnerability (CVSS 4.4) in Spring Amqp, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. Fixed in org.springframework.amqp:spring-amqp 4.0.4.
References
spring.io/security/cve-2026-41701
nvd.nist.gov/vuln/detail/CVE-2026-41701
github.com/spring-projects/spring-amqp/releases/tag/v3.2.11
Left out here: 103 versions. The JSON record has them.