CVE-2026-59272 Log4j2 AmqpAppender disables TLS hostname verification by default
Attackers can intercept log data via man-in-the-middle attacks because the Log4j2 AmqpAppender disables TLS hostname verification by default.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59272?
CVE-2026-59272 is a medium-severity vulnerability in Spring AMQP, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Weakness: CWE-297
Which versions are affected by CVE-2026-59272?
It affects 1 product.
Products include Vmware Spring Advanced Message Queuing Protocol.
How do I fix CVE-2026-59272?
Upgrade to a fixed version.
Is CVE-2026-59272 being exploited?
There is no known exploitation of CVE-2026-59272 in the wild and no public exploit code.
Other vulnerabilities in Spring AMQP
- CVE-2026-59275 Deserialization in Spring AMQP
- CVE-2026-59320 In Spring AMQP the link credit never replenished on listener exception path
- CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies
- CVE-2021-22095 Deserialization of Untrusted Data in Spring AMQP
- CVE-2021-22097 Deserialization of Untrusted Data in Spring AMQP
Sources
Also known as GHSA-fp2f-68v2-xw9x.