Every CVE Search/ Get API key

CVE-2026-41714

In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

4.0 MediumFix available

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.13%Up 0.1 points since Jun 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.0

In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Record
CVE-2026-41714
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-295
Updated
2026-11-02
EUVDEUVD-2026-35898 4.0

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Record
EUVD-2026-35898
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-p8qj-fj6r-w7q9 4.0

Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Record
GHSA-p8qj-fj6r-w7q9
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-295
Updated
2026-11-02
NVD 4.0

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Record
CVE-2026-41714
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-295
Updated
2026-11-02
OSV 4.0

In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Record
CVE-2026-41714
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVGHSA-p8qj-fj6r-w7q9 4.0

Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Record
GHSA-p8qj-fj6r-w7q9
CVSS 3.1
4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-295
Updated
2026-11-02
Show 5 moreShow less
OSVCLSA-2026-1791361557 No score

TuxCare security update for org.springframework.amqp:spring-amqp (2 CVEs)

TuxCare rebuilt org.springframework.amqp:spring-amqp to address 2 CVEs. Fixed in 3.1.12-tuxcare.6.

Record
CLSA-2026-1791361557
Updated
2026-11-02
OSVCLSA-2026-1792078191 No score

TuxCare security update for org.springframework.amqp (6 CVEs)

TuxCare rebuilt 3 org.springframework.amqp packages to address 6 CVEs. Fixed in 3.1.11-tuxcare.1.

Record
CLSA-2026-1792078191
Updated
2026-11-02
OSVCLSA-2026-1793728143 No score

TuxCare security update for org.springframework.amqp:spring-amqp (2 CVEs)

TuxCare rebuilt org.springframework.amqp:spring-amqp to address 2 CVEs. Fixed in 3.2.8-tuxcare.3.

Record
CLSA-2026-1793728143
Updated
2026-11-04
OSVCLSA-2026-1793732045 No score

TuxCare security update for org.springframework.amqp:spring-amqp (1 CVE)

TuxCare rebuilt org.springframework.amqp:spring-amqp to address 1 CVE. Fixed in 3.1.8-tuxcare.7.

Record
CLSA-2026-1793732045
Updated
2026-11-04
OSVROOT-APP-MAVEN-CVE-2026-41714 No score

CVE-2026-41714 in io.root.org.springframework.amqp:spring-amqp - Patched by Root

Root has patched CVE-2026-41714 in the io.root.org.springframework.amqp:spring-amqp package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2026-41714
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.springframework.amqp:spring-amqp
Maven
 4.0.0 to 4.0.3
4.0.4
org.springframework.amqp:spring-amqp
Maven
 3.2.0 to 3.2.10
3.2.11
org.springframework.amqp:spring-amqp
Maven
 3.1.0 to 3.1.15 None known
org.springframework.amqp:spring-amqp
Maven
 through 2.4.17 None known
org.springframework.amqp:spring-amqp
TuxCare:Maven
From an advisory covering 2 CVEs
 3.1.12 up to 3.1.12-tuxcare.6, plus listed versions
3.1.12-tuxcare.13.1.12-tuxcare.23.1.12-tuxcare.33.1.12-tuxcare.43.1.12-tuxcare.5
3.1.12-tuxcare.6
org.springframework.amqp:spring-amqp
TuxCare:Maven
From an advisory covering 6 CVEs
 3.1.11 up to 3.1.11-tuxcare.1
3.1.11-tuxcare.1
org.springframework.amqp:spring-rabbit
TuxCare:Maven
From an advisory covering 6 CVEs
 3.1.11 up to 3.1.11-tuxcare.1
3.1.11-tuxcare.1
org.springframework.amqp:spring-rabbit-junit
TuxCare:Maven
From an advisory covering 6 CVEs
 3.1.11 up to 3.1.11-tuxcare.1
3.1.11-tuxcare.1
org.springframework.amqp:spring-amqp
TuxCare:Maven
From an advisory covering 2 CVEs
 3.2.8 up to 3.2.8-tuxcare.3, plus listed versions
3.2.8-tuxcare.13.2.8-tuxcare.2
3.2.8-tuxcare.3
org.springframework.amqp:spring-amqp
TuxCare:Maven
 3.1.8 up to 3.1.8-tuxcare.7, plus listed versions
3.1.8-tuxcare.13.1.8-tuxcare.23.1.8-tuxcare.33.1.8-tuxcare.43.1.8-tuxcare.53.1.8-tuxcare.6
3.1.8-tuxcare.7
Show 6 moreShow less
Affected packages
PackageAffectedFixed
org.springframework.amqp:spring-amqp
Maven
 4.0.0 up to 4.0.4, plus listed versions
4.0.14.0.24.0.3
4.0.4
org.springframework.amqp:spring-amqp
Maven
 3.2.0 up to 3.2.11, plus listed versions
3.2.13.2.103.2.23.2.33.2.4
Show 5 moreShow less
3.2.53.2.63.2.73.2.83.2.9
3.2.11
org.springframework.amqp:spring-amqp
Maven
 3.1.0 to 3.1.15, plus listed versions
3.1.13.1.103.1.113.1.123.1.2
Show 7 moreShow less
3.1.33.1.43.1.53.1.63.1.73.1.83.1.9
 None known
org.springframework.amqp:spring-amqp
Maven
 through 2.4.17, plus listed versions
1.0.0.RELEASE1.1.0.RELEASE1.1.1.RELEASE1.1.2.RELEASE1.1.3.RELEASE
Show 45 moreShow less
1.1.4.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.3.9.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.2.RELEASE1.5.3.RELEASE1.5.4.RELEASE1.5.5.RELEASE1.5.6.RELEASE1.5.7.RELEASE1.6.0.RELEASE1.6.1.RELEASE1.6.10.RELEASE1.6.11.RELEASE1.6.2.RELEASE1.6.3.RELEASE1.6.4.RELEASE1.6.5.RELEASE1.6.6.RELEASE1.6.7.RELEASE1.6.8.RELEASE1.6.9.RELEASE1.7.0.RELEASE1.7.1.RELEASE1.7.10.RELEASE1.7.11.RELEASE
 None known
io.root.org.springframework.amqp:spring-amqp
Root:Maven
 before 3.2.5-root.io.1
3.2.5-root.io.1
org.springframework.amqp:spring-amqp
Root:Maven
 before 3.2.5-aikido.1
3.2.5-aikido.1

History

History
RecordedChangedSources
affected
affected, aliases, factsOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41714 is a medium vulnerability (CVSS 4.0) in Spring Amqp, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in org.springframework.amqp:spring-amqp 4.0.4.

References

This page doesn't list everything

Left out here: 103 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open