Executive brief
Spring Boot is a popular framework used to build Java-based business applications. A security issue exists where applications using RabbitMQ for messaging do not properly verify the identity of the server they are connecting to when using SSL bundles. This could allow an attacker positioned on the same local network to intercept or manipulate sensitive business data transmitted between the application and the message broker.
Technical details
A vulnerability exists in Spring Boot's RabbitMQ auto-configuration component (CWE-295). When the application is configured to use SSL bundles for secure communication, it fails to perform mandatory hostname verification during the TLS handshake with the RabbitMQ broker. An attacker with adjacent network access could exploit this by presenting a spoofed certificate, enabling a Man-in-the-Middle (MitM) attack to intercept or alter traffic. The issue affects Spring Boot versions 3.5.x and 4.0.x and is resolved in versions 3.5.14 and 4.0.6 respectively.
Affected products
- VMware Spring Boot 3.5.0 to 3.5.13, 4.0.0 to 4.0.5
Timeline
- 2026-04-27: disclosed
- 2026-04-27: advisory