Executive brief
Spring AMQP is a library used by Java applications to communicate with RabbitMQ message brokers. A security flaw in how the library tracks message replies makes it possible for an attacker to predict the ID of a pending response. This could allow an unauthorized party to inject a fake response or intercept data, potentially disrupting business workflows or compromising the integrity of automated tasks.
Technical details
The vulnerability exists in the RabbitTemplate.sendAndReceive() method of Spring AMQP when configured with a fixed reply queue. The root cause is the use of a predictable internal simple counter to generate correlation IDs for message replies, rather than a cryptographically secure random value. An attacker with sufficient privileges to publish messages to the broker could predict future correlation IDs and inject spoofed responses into the reply queue. This could lead to a loss of message integrity or unauthorized data exposure within the application's request-response cycle. The issue is addressed in versions 3.2.11 and 4.0.4.
Affected products
- VMware Spring AMQP 4.0.0 to 4.0.3, 3.2.0 to 3.2.10, 3.1.0 to 3.1.15, 2.4.0 to 2.4.17
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-08-12: patched