MEDIUM | JUNE 09, 2026 | CVE-2026-41714
Description
Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
Affected Spring Products and Versions
Spring AMQP:
- 4.0.0 - 4.0.3
- 3.2.0 - 3.2.10
- 3.1.0 - 3.1.15
- 2.4.0 - 2.4.17
Versions that are no longer supported are also affected.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 4.0.x | 4.0.4 | OSS |
| 4.0.3.1 | Commercial | |
| 3.2.x | 3.2.11 | OSS |
| 3.2.10.1 | Commercial | |
| 3.1.x | 3.1.16 | Commercial |
| 2.4.x | 2.4.18 | Commercial |
No further mitigation steps are necessary.
Credit
This issue was discovered internally.
References
History
- 2026-06-09: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy