4.4

CVE-2026-41701

In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.

Affected versions:
Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Spring Advanced Message Queuing Protocol Version >= 3.1.0 < 3.1.16
VMware ≫ Spring Advanced Message Queuing Protocol Version >= 3.2.0 < 3.2.10.1
VMware ≫ Spring Advanced Message Queuing Protocol Version >= 4.0.0 < 4.0.3.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.069
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
VMware 4.4 1.3 2.7
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

https://spring.io/security/cve-2026-41701
Vendor Advisory