Spring Advanced Message Queuing Protocol
Monthly
Denial-of-service in Spring AMQP across multiple supported release lines allows a privileged AMQP publisher to force a System.exit(99) call inside the consumer JVM, killing the entire process rather than isolating the failure to the listener thread. Affected versions span the 2.4.x, 3.2.x, 4.0.x, and 4.1.0 release trains, covering a wide swath of actively maintained Spring deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total, immediate JVM termination and the collateral impact on every co-located workload make this operationally significant in RabbitMQ-integrated Spring environments.
Cleartext credential exposure in Spring AMQP affects applications that use the RabbitMQ management aliveness check: when that check fails at runtime, the configured admin password is embedded verbatim in the thrown Java exception message, making it visible to anyone with access to exception output. The vulnerability spans multiple major release lines - 2.4.x, 3.2.x, and 4.0.x through 4.1.0 - and was reported by security@vmware.com, the Spring Security team. No public exploit code has been identified at time of analysis and CISA KEV status is unconfirmed, but a successful credential leak would yield full RabbitMQ administrative control.
Improper certificate validation in Spring AMQP allows a network-positioned attacker to perform a man-in-the-middle attack against applications that configure broker connections via RabbitConnectionFactoryBean.setUri("amqps://...") without explicitly calling setUseSSL(true). Affected are Spring AMQP versions 2.4.0 through 4.0.3 across four release lines. Although TLS encryption is established, the absence of certificate chain validation and hostname verification means a rogue broker can impersonate the legitimate RabbitMQ instance, exposing message content in transit. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 21.3%.
Denial-of-service in Spring AMQP across multiple supported release lines allows a privileged AMQP publisher to force a System.exit(99) call inside the consumer JVM, killing the entire process rather than isolating the failure to the listener thread. Affected versions span the 2.4.x, 3.2.x, 4.0.x, and 4.1.0 release trains, covering a wide swath of actively maintained Spring deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total, immediate JVM termination and the collateral impact on every co-located workload make this operationally significant in RabbitMQ-integrated Spring environments.
Cleartext credential exposure in Spring AMQP affects applications that use the RabbitMQ management aliveness check: when that check fails at runtime, the configured admin password is embedded verbatim in the thrown Java exception message, making it visible to anyone with access to exception output. The vulnerability spans multiple major release lines - 2.4.x, 3.2.x, and 4.0.x through 4.1.0 - and was reported by security@vmware.com, the Spring Security team. No public exploit code has been identified at time of analysis and CISA KEV status is unconfirmed, but a successful credential leak would yield full RabbitMQ administrative control.
Improper certificate validation in Spring AMQP allows a network-positioned attacker to perform a man-in-the-middle attack against applications that configure broker connections via RabbitConnectionFactoryBean.setUri("amqps://...") without explicitly calling setUseSSL(true). Affected are Spring AMQP versions 2.4.0 through 4.0.3 across four release lines. Although TLS encryption is established, the absence of certificate chain validation and hostname verification means a rogue broker can impersonate the legitimate RabbitMQ instance, exposing message content in transit. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV.
In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 21.3%.