CVE-2026-40971: Spring Boot's RabbitMQ auto-configuration doesn't perform hostname verification when connecting to the RabbitMQ broker

April 28, 2026 (updated May 6, 2026)

When configured to use an SSL bundle, Spring Boot’s RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.

Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.

References

github.com/advisories/GHSA-9vc8-qppq-wvxc
nvd.nist.gov/vuln/detail/CVE-2026-40971
spring.io/security/cve-2026-40971

Code Behaviors & Features

Detect and mitigate CVE-2026-40971 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →