CVE-2026-41714: Spring AMQP Core: Missing Certificate and Hostname Verification for amqps URIs in RabbitConnectionFactoryBean

June 10, 2026 (updated August 12, 2026)

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri(“amqps://…”) without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

References

github.com/advisories/GHSA-p8qj-fj6r-w7q9
github.com/spring-projects/spring-amqp/releases/tag/v3.2.11
github.com/spring-projects/spring-amqp/releases/tag/v4.0.4
nvd.nist.gov/vuln/detail/CVE-2026-41714
spring.io/security/cve-2026-41714

Code Behaviors & Features

Detect and mitigate CVE-2026-41714 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →