CVE-2026-59272

Published: Aug 27, 2026Modified: Sep 1, 2026

6.8

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 1.6 / Impact: 5.2

Source: security@vmware.com (Secondary)

Description

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Affected (4)

Products: Vmware: Spring Advanced Message Queuing Protocol

Vmware

1 product

Spring Advanced Message Queuing Protocol

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Advanced Message Queuing Protocol	Before 2.4.19
Vmware Spring Advanced Message Queuing Protocol	From 3.2.0 to 3.2.13
Vmware Spring Advanced Message Queuing Protocol	From 4.0.0 to 4.0.4.1
Vmware Spring Advanced Message Queuing Protocol	From 4.1.0 to 4.1.0.1

Related CWEs

CWE-297

Improper Validation of Certificate with Host Mismatch

The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

References (1)

https://spring.io/security/cve-2026-59272

Source: security@vmware.com

Vendor Advisory

Timeline

No history available yet.