Is CVE-2026-40971 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40971 being exploited in the wild.

How severe is CVE-2026-40971?

Medium severity, with a CVSS score of 5, published 27 April 2026.

Which products and versions are affected?

org.springframework.boot:spring-boot-rabbitmq (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.6; VMware Spring Boot 3.5.0 to 3.5.13, 4.0.0 to 4.0.5, 4.0.0 to 4.0.5, 3.5.0 to 3.5.13.

Is there a fix for CVE-2026-40971?

Yes. org.springframework.boot:spring-boot-rabbitmq (Maven): upgrade to 4.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40971 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-40971?

Check whether you run org.springframework.boot:spring-boot-rabbitmq (Maven) or VMware Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40971: VMware Spring Boot improper certificate validation in RabbitMQ auto-configuration

CVE-2026-40971 · Severity: medium · CVSS 5 · Published 2026-04-27

Spring Boot is a popular framework used to build Java-based business applications. A security issue exists where applications using RabbitMQ for messaging do not properly verify the identity of the server they are connecting to when using SSL bundles. This could allow an attacker positioned on the same local network to intercept or manipulate sensitive business data transmitted between the application and the message broker.

Technologies: VMware Spring Boot. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-40971 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40971 being exploited in the wild.
How severe is CVE-2026-40971?: Medium severity, with a CVSS score of 5, published 27 April 2026.
Which products and versions are affected?: org.springframework.boot:spring-boot-rabbitmq (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.6; VMware Spring Boot 3.5.0 to 3.5.13, 4.0.0 to 4.0.5, 4.0.0 to 4.0.5, 3.5.0 to 3.5.13.
Is there a fix for CVE-2026-40971?: Yes. org.springframework.boot:spring-boot-rabbitmq (Maven): upgrade to 4.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40971 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-40971?: Check whether you run org.springframework.boot:spring-boot-rabbitmq (Maven) or VMware Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.springframework.boot:spring-boot-rabbitmq (Maven): upgrade to 4.0.6 or later

# set org.springframework.boot:spring-boot-rabbitmq to 4.0.6 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Spring Boot's RabbitMQ auto-configuration component (CWE-295). When the application is configured to use SSL bundles for secure communication, it fails to perform mandatory hostname verification during the TLS handshake with the RabbitMQ broker. An attacker with adjacent network access could exploit this by presenting a spoofed certificate, enabling a Man-in-the-Middle (MitM) attack to intercept or alter traffic. The issue affects Spring Boot versions 3.5.x and 4.0.x and is resolved in versions 3.5.14 and 4.0.6 respectively.

Affected products

VMware Spring Boot 3.5.0 to 3.5.13, 4.0.0 to 4.0.5

Identifiers

CVE-2026-40971
GHSA-9vc8-qppq-wvxc

Timeline

2026-04-27: disclosed
2026-04-27: advisory

References

https://spring.io/security/cve-2026-40971

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.