← Back

CVE-2026-41714

nvd nist
Published: Jun 10, 2026Modified: Jul 17, 2026

JSON object

Loading...
4.0
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Exploitability: 2.2 / Impact: 1.4
Source: security@vmware.com (Secondary)

Description

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Affected (4)

Vmware
1 product
Spring Advanced Message Queuing Protocol
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Advanced Message Queuing Protocol
Before 2.4.18
Spring Advanced Message Queuing Protocol
From 3.1.0 to 3.1.16
Spring Advanced Message Queuing Protocol
From 3.2.0 to 3.2.10.1
Spring Advanced Message Queuing Protocol
From 4.0.0 to 4.0.3.1

Related CWEs

CWE-295
Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.