CVE-2026-41714

Name of the Vulnerable Software and Affected Versions Spring AMQP versions 4.0.0 through 4.0.3 Spring AMQP versions 3.2.0 through 3.2.10 Spring AMQP versions 3.1.0 through 3.1.15 Spring AMQP versions 2.4.0 through 2.4.17

Description Applications that configure their broker connection using the setUri("amqps://...") method within RabbitConnectionFactoryBean without calling setUseSSL(true) will have TLS encryption enabled but without certificate validation or hostname verification.

Recommendations For versions 4.0.0 through 4.0.3, call setUseSSL(true) when configuring the broker connection via setUri("amqps://..."). For versions 3.2.0 through 3.2.10, call setUseSSL(true) when configuring the broker connection via setUri("amqps://..."). For versions 3.1.0 through 3.1.15, call setUseSSL(true) when configuring the broker connection via setUri("amqps://..."). For versions 2.4.0 through 2.4.17, call setUseSSL(true) when configuring the broker connection via setUri("amqps://...").