Read the docs
TI-2026-30217 Aliases CVE-2026-41701GHSA-p5f7-rjhp-pxvc

In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

Priority LOW 20CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00173 6th percentileScored 2026-11-07
Fix Partial Spring AMQP (Spring): 4.0.3.1, 3.2.10.1, 3.1.16 +1org.springframework.amqp:spring-amqp (Maven): 4.0.4, 3.2.11Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring AMQP4.0.0 to before 4.0.3.1; 3.2.0 to before 3.2.10.1; 3.1.0 to before 3.1.16; 2.4.0 to before 2.4.184.0.3.1, 3.2.10.1, 3.1.16, 2.4.18Patch availableCNA
—org.springframework.amqp:spring-amqp (Maven)4.0.0 to before 4.0.44.0.4Patch availableGHSA-p5f7-rjhp-pxvc
—org.springframework.amqp:spring-amqp (Maven)3.2.0 to before 3.2.113.2.11Patch availableGHSA-p5f7-rjhp-pxvc
—org.springframework.amqp:spring-amqp (Maven)3.1.0 – 3.1.15—No fix listedGHSA-p5f7-rjhp-pxvc
—org.springframework.amqp:spring-amqp (Maven)up to 2.4.17—No fix listedGHSA-p5f7-rjhp-pxvc
  • Spring AMQP VendorVMware Affected 4.0.0 to before 4.0.3.1; 3.2.0 to before 3.2.10.1; 3.1.0 to before 3.1.16; 2.4.0 to before 2.4.18 Fixed in 4.0.3.1, 3.2.10.1, 3.1.16, 2.4.18 Patch available CNA
  • org.springframework.amqp:spring-amqp (Maven) Vendor— Affected 4.0.0 to before 4.0.4 Fixed in 4.0.4 Patch available GHSA-p5f7-rjhp-pxvc
  • org.springframework.amqp:spring-amqp (Maven) Vendor— Affected 3.2.0 to before 3.2.11 Fixed in 3.2.11 Patch available GHSA-p5f7-rjhp-pxvc
  • org.springframework.amqp:spring-amqp (Maven) Vendor— Affected 3.1.0 – 3.1.15 Fixed in — No fix listed GHSA-p5f7-rjhp-pxvc
  • org.springframework.amqp:spring-amqp (Maven) Vendor— Affected up to 2.4.17 Fixed in — No fix listed GHSA-p5f7-rjhp-pxvc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*before 2.4.18; 3.1.0 to before 3.1.16; 3.2.0 to before 3.2.10.1; 4.0.0 to before 4.0.3.1VulnerableVMware
  • cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:* Versions before 2.4.18; 3.1.0 to before 3.1.16; 3.2.0 to before 3.2.10.1; 4.0.0 to before 4.0.3.1 Vulnerable ·VMware

Remediation

  • Fix · CNA Spring AMQP (Spring) Fixed in 4.0.3.1, 3.2.10.1, 3.1.16, 2.4.18
  • Fix · GHSA-p5f7-rjhp-pxvc org.springframework.amqp:spring-amqp (Maven) Fixed in 4.0.4 Advisory →
  • Fix · GHSA-p5f7-rjhp-pxvc org.springframework.amqp:spring-amqp (Maven) Fixed in 3.2.11 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Spring AMQP 2.4.18, 3.1.16 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-30230 Improper certificate validation in VMware Spring AMQPPriority LOW 18
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41701
  2. 2026-10-03 Alias added: GHSA-p5f7-rjhp-pxvc

References

Advisory 2

Other 3

  • TI-2016-01983 org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5… CVSS 3.1CRITICAL 9.8
  • TI-2026-42408 Deserialization of untrusted data in VMware Spring AMQP CVSS 3.1MEDIUM 6.6
  • TI-2026-42406 Log4j2 AmqpAppender disables TLS hostname verification by default CVSS 3.1MEDIUM 6.8
  • TI-2021-05100 Deserialization of untrusted data in Spring AMQP CVSS 3.1MEDIUM 6.5
  • TI-2021-05098 Deserialization of untrusted data in Spring AMQP CVSS 3.1MEDIUM 6.5
  • TI-2026-42451 In Spring AMQP the link credit never replenished on listener exception path CVSS 3.1MEDIUM 6.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences