CVE-2026-59272
Log4j2 AmqpAppender disables TLS hostname verification by default
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Log4j2 AmqpAppender disables TLS hostname verification by default
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Record
CVE-2026-59272- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
EUVDEUVD-2026-67093
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Record
EUVD-2026-67093- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fp2f-68v2-xw9x
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the...
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Record
GHSA-fp2f-68v2-xw9x- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
NVD
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Record
CVE-2026-59272- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-297
- Updated
- 2026-11-02
OSV
Log4j2 AmqpAppender disables TLS hostname verification by default
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Record
CVE-2026-59272- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1792063484 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.2.12-tuxcare.2.
- Record
CLSA-2026-1792063484- Updated
- 2026-11-02
Show 18 moreShow less
OSVCLSA-2026-1792070331 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.2.11-tuxcare.2.
- Record
CLSA-2026-1792070331- Updated
- 2026-11-02
OSVCLSA-2026-1792075826 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.16-tuxcare.2.
- Record
CLSA-2026-1792075826- Updated
- 2026-11-02
OSVCLSA-2026-1792075935 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.2.8-tuxcare.1.
- Record
CLSA-2026-1792075935- Updated
- 2026-11-02
OSVCLSA-2026-1792076060 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.0.10-tuxcare.3.
- Record
CLSA-2026-1792076060- Updated
- 2026-11-02
OSVCLSA-2026-1792076165 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.17-tuxcare.9.
- Record
CLSA-2026-1792076165- Updated
- 2026-11-02
OSVCLSA-2026-1792077747 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 4 CVEs. Fixed in 2.3.10-tuxcare.1.
- Record
CLSA-2026-1792077747- Updated
- 2026-11-02
OSVCLSA-2026-1792077762 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 4 CVEs. Fixed in 2.3.6-tuxcare.1.
- Record
CLSA-2026-1792077762- Updated
- 2026-11-02
OSVCLSA-2026-1792077802 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.4-tuxcare.1.
- Record
CLSA-2026-1792077802- Updated
- 2026-11-02
OSVCLSA-2026-1792078059 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.12-tuxcare.2.
- Record
CLSA-2026-1792078059- Updated
- 2026-11-02
OSVCLSA-2026-1792078119 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.1.12-tuxcare.7.
- Record
CLSA-2026-1792078119- Updated
- 2026-11-02
OSVCLSA-2026-1792078146 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.3.16-tuxcare.2.
- Record
CLSA-2026-1792078146- Updated
- 2026-11-02
OSVCLSA-2026-1792078191 No score
TuxCare security update for org.springframework.amqp (6 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 6 CVEs. Fixed in 3.1.11-tuxcare.1.
- Record
CLSA-2026-1792078191- Updated
- 2026-11-02
OSVCLSA-2026-1792082894 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.3.7-tuxcare.3.
- Record
CLSA-2026-1792082894- Updated
- 2026-11-02
OSVCLSA-2026-1792083004 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.1.8-tuxcare.5.
- Record
CLSA-2026-1792083004- Updated
- 2026-11-02
OSVCLSA-2026-1792084967 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.1.4.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792084967- Updated
- 2026-11-02
OSVCLSA-2026-1792086053 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.2.
- Record
CLSA-2026-1792086053- Updated
- 2026-11-02
OSVCLSA-2026-1792088148 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 4 CVEs. Fixed in 2.2.12.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792088148- Updated
- 2026-11-02
OSVCLSA-2026-1793186461 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 4 CVEs. Fixed in 2.1.17.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793186461- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.2.12 up to 3.2.12-tuxcare.2, plus listed versions 3.2.12-tuxcare.1 |
3.2.12-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.12 up to 3.2.12-tuxcare.2, plus listed versions 3.2.12-tuxcare.1 |
3.2.12-tuxcare.2 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.12 up to 3.2.12-tuxcare.2, plus listed versions 3.2.12-tuxcare.1 |
3.2.12-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.2.11 up to 3.2.11-tuxcare.2, plus listed versions 3.2.11-tuxcare.1 |
3.2.11-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.11 up to 3.2.11-tuxcare.2, plus listed versions 3.2.11-tuxcare.1 |
3.2.11-tuxcare.2 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.11 up to 3.2.11-tuxcare.2, plus listed versions 3.2.11-tuxcare.1 |
3.2.11-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.4.16 up to 2.4.16-tuxcare.2, plus listed versions 2.4.16-tuxcare.1 |
2.4.16-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.4.16 up to 2.4.16-tuxcare.2, plus listed versions 2.4.16-tuxcare.1 |
2.4.16-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.2.8 up to 3.2.8-tuxcare.1 | 3.2.8-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.8 up to 3.2.8-tuxcare.1 | 3.2.8-tuxcare.1 |
Show 35 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.8 up to 3.2.8-tuxcare.1 | 3.2.8-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.0.10 up to 3.0.10-tuxcare.3, plus listed versions 3.0.10-tuxcare.13.0.10-tuxcare.2 |
3.0.10-tuxcare.3 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.0.10 up to 3.0.10-tuxcare.3, plus listed versions 3.0.10-tuxcare.13.0.10-tuxcare.2 |
3.0.10-tuxcare.3 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.0.10 up to 3.0.10-tuxcare.3, plus listed versions 3.0.10-tuxcare.13.0.10-tuxcare.2 |
3.0.10-tuxcare.3 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.4.17 up to 2.4.17-tuxcare.9, plus listed versions 2.4.17-tuxcare.22.4.17-tuxcare.32.4.17-tuxcare.42.4.17-tuxcare.52.4.17-tuxcare.6 Show 4 moreShow less2.4.17-tuxcare.72.4.17-tuxcare.82.4.17.tuxcare2.4.17.tuxcare.1 |
2.4.17-tuxcare.9 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.4.17 up to 2.4.17-tuxcare.9, plus listed versions 2.4.17-tuxcare.22.4.17-tuxcare.32.4.17-tuxcare.42.4.17-tuxcare.52.4.17-tuxcare.6 Show 4 moreShow less2.4.17-tuxcare.72.4.17-tuxcare.82.4.17.tuxcare2.4.17.tuxcare.1 |
2.4.17-tuxcare.9 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
2.3.10 up to 2.3.10-tuxcare.1 | 2.3.10-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
2.3.10 up to 2.3.10-tuxcare.1 | 2.3.10-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
2.3.6 up to 2.3.6-tuxcare.1 | 2.3.6-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
2.3.6 up to 2.3.6-tuxcare.1 | 2.3.6-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.4.4 up to 2.4.4-tuxcare.1 | 2.4.4-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.4.4 up to 2.4.4-tuxcare.1 | 2.4.4-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.4.12 up to 2.4.12-tuxcare.2, plus listed versions 2.4.12-tuxcare.1 |
2.4.12-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.4.12 up to 2.4.12-tuxcare.2, plus listed versions 2.4.12-tuxcare.1 |
2.4.12-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.1.12 up to 3.1.12-tuxcare.7, plus listed versions 3.1.12-tuxcare.13.1.12-tuxcare.23.1.12-tuxcare.33.1.12-tuxcare.43.1.12-tuxcare.53.1.12-tuxcare.6 |
3.1.12-tuxcare.7 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.1.12 up to 3.1.12-tuxcare.7, plus listed versions 3.1.12-tuxcare.13.1.12-tuxcare.23.1.12-tuxcare.33.1.12-tuxcare.43.1.12-tuxcare.53.1.12-tuxcare.6 |
3.1.12-tuxcare.7 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.1.12 up to 3.1.12-tuxcare.7, plus listed versions 3.1.12-tuxcare.13.1.12-tuxcare.23.1.12-tuxcare.33.1.12-tuxcare.43.1.12-tuxcare.53.1.12-tuxcare.6 |
3.1.12-tuxcare.7 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.3.16 up to 2.3.16-tuxcare.2, plus listed versions 2.3.16-tuxcare.1 |
2.3.16-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.3.16 up to 2.3.16-tuxcare.2, plus listed versions 2.3.16-tuxcare.1 |
2.3.16-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 6 CVEs |
3.1.11 up to 3.1.11-tuxcare.1 | 3.1.11-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 6 CVEs |
3.1.11 up to 3.1.11-tuxcare.1 | 3.1.11-tuxcare.1 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 6 CVEs |
3.1.11 up to 3.1.11-tuxcare.1 | 3.1.11-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.3.7 up to 2.3.7-tuxcare.3, plus listed versions 2.3.7-tuxcare.12.3.7-tuxcare.2 |
2.3.7-tuxcare.3 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.3.7 up to 2.3.7-tuxcare.3, plus listed versions 2.3.7-tuxcare.12.3.7-tuxcare.2 |
2.3.7-tuxcare.3 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.1.8 up to 3.1.8-tuxcare.5, plus listed versions 3.1.8-tuxcare.13.1.8-tuxcare.23.1.8-tuxcare.33.1.8-tuxcare.4 |
3.1.8-tuxcare.5 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.1.8 up to 3.1.8-tuxcare.5, plus listed versions 3.1.8-tuxcare.13.1.8-tuxcare.23.1.8-tuxcare.33.1.8-tuxcare.4 |
3.1.8-tuxcare.5 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.1.8 up to 3.1.8-tuxcare.5, plus listed versions 3.1.8-tuxcare.13.1.8-tuxcare.23.1.8-tuxcare.33.1.8-tuxcare.4 |
3.1.8-tuxcare.5 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.1.4.RELEASE up to 2.1.4.RELEASE-tuxcare.1 | 2.1.4.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.1.4.RELEASE up to 2.1.4.RELEASE-tuxcare.1 | 2.1.4.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.2, plus listed versions 2.1.8.RELEASE-tuxcare.1 |
2.1.8.RELEASE-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.2, plus listed versions 2.1.8.RELEASE-tuxcare.1 |
2.1.8.RELEASE-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
2.2.12.RELEASE up to 2.2.12.RELEASE-tuxcare.1 | 2.2.12.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
2.2.12.RELEASE up to 2.2.12.RELEASE-tuxcare.1 | 2.2.12.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
2.1.17.RELEASE up to 2.1.17.RELEASE-tuxcare.1 | 2.1.17.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
2.1.17.RELEASE up to 2.1.17.RELEASE-tuxcare.1 | 2.1.17.RELEASE-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59272 is a medium vulnerability (CVSS 6.8) in Spring Amqp, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. No source names a fixed version.