What is the CVSS score of EUVD-2026-35898?

EUVD-2026-35898 has a CVSS 3.1 base score of 4.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-35898?

Yes, a patch is available for EUVD-2026-35898. Update the affected software to the latest version immediately.

Spring AMQP EUVD-2026-35898

| CVE-2026-41714 MEDIUM

Improper Certificate Validation (CWE-295)

2026-06-10 security@vmware.com

GHSA-p8qj-fj6r-w7q9

Information Disclosure Java

4.0

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

4.0 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:42 vuln.today

DescriptionCVE.org

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

AnalysisAI

Improper certificate validation in Spring AMQP allows a network-positioned attacker to perform a man-in-the-middle attack against applications that configure broker connections via RabbitConnectionFactoryBean.setUri("amqps://...") without explicitly calling setUseSSL(true). Affected are Spring AMQP versions 2.4.0 through 4.0.3 across four release lines. Although TLS encryption is established, the absence of certificate chain validation and hostname verification means a rogue broker can impersonate the legitimate RabbitMQ instance, exposing message content in transit. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.

Technical ContextAI

Spring AMQP is a Java messaging framework (reported by security@vmware.com, the Spring/Broadcom security team) built on top of the AMQP protocol for RabbitMQ integration. The root cause is CWE-295 (Improper Certificate Validation): RabbitConnectionFactoryBean contains a behavioral split between two configuration paths. When setUri("amqps://...") is called - the URI scheme that signals TLS intent - the factory enables encryption at the transport layer but does NOT automatically activate certificate chain validation or hostname verification unless setUseSSL(true) is also explicitly invoked. This creates a silent misconfiguration where the application developer believes they have secure, authenticated TLS but has actually only achieved confidentiality-without-authentication. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the connection factory itself to downstream consumers of AMQP message data. No CPE strings were supplied in the available intelligence; affected versions span the 2.4.x, 3.1.x, 3.2.x, and 4.0.x release lines.

RemediationAI

Upstream fix is available per vendor advisory at https://spring.io/security/cve-2026-41714; however, exact patched version numbers were not included in the available intelligence and must be confirmed directly from the Spring advisory before upgrading. As a code-level fix applicable to all affected versions, every call to RabbitConnectionFactoryBean.setUri("amqps://...") must be paired with an explicit call to setUseSSL(true) on the same factory instance - this activates certificate chain validation and hostname verification. Development teams should audit all Spring AMQP connection factory configurations, including Spring Boot auto-configuration properties, XML application contexts, and programmatic bean definitions, to identify any amqps:// URI usage lacking the SSL flag. As a compensating control where code changes are not immediately deployable, restrict the network path between Spring AMQP applications and their RabbitMQ brokers to a dedicated, isolated VLAN or security group that prevents third-party hosts from intercepting traffic; note this reduces but does not eliminate the attack surface, as insider threats or compromised network devices on that segment could still exploit the validation gap.