CVE-2026-41701 In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Attackers can poison replies on fixed reply queues in Spring AMQP by predicting sequential correlation IDs, potentially altering application data flow.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41701?
CVE-2026-41701 is a medium-severity vulnerability in Spring AMQP, published on 9 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Weakness: CWE-330
Which versions are affected by CVE-2026-41701?
8 open source packages ship an affected version, including org.springframework.amqp:spring-amqp. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.amqp:spring-amqp Maven | All versions to 2.4.17 | None |
org.springframework.amqp:spring-amqp Maven | All versions to 2.4.17 | None |
org.springframework.amqp:spring-amqp Maven | From 3.1.0 to 3.1.15 | None |
org.springframework.amqp:spring-amqp Maven | From 3.1.0 to 3.1.15 | None |
org.springframework.amqp:spring-amqp Maven | From 3.2.0 | 3.2.11 |
org.springframework.amqp:spring-amqp Maven | From 3.2.0 | 3.2.11 |
2 more packages
org.springframework.amqp:spring-amqp Maven | From 4.0.0 | 4.0.4 |
org.springframework.amqp:spring-amqp Maven | From 4.0.0 | 4.0.4 |
Products include Vmware Spring Advanced Message Queuing Protocol.
How do I fix CVE-2026-41701?
Upgrade org.springframework.amqp:spring-amqp to a fixed version for your release line: 3.2.11 or 4.0.4.
Is CVE-2026-41701 being exploited?
There is no known exploitation of CVE-2026-41701 in the wild and no public exploit code.
Other vulnerabilities in Spring AMQP
- CVE-2026-59272 Log4j2 AmqpAppender disables TLS hostname verification by default
- CVE-2026-59275 Deserialization in Spring AMQP
- CVE-2026-59320 In Spring AMQP the link credit never replenished on listener exception path
- CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies
- CVE-2021-22095 Deserialization of Untrusted Data in Spring AMQP
Sources
Also known as GHSA-p5f7-rjhp-pxvc, ROOT-APP-MAVEN-CVE-2026-41701.