Is CVE-2026-41714 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41714 being exploited in the wild.

How severe is CVE-2026-41714?

Medium severity, with a CVSS score of 4, published 10 June 2026.

Which products and versions are affected?

org.springframework.amqp:spring-amqp (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.4; VMware Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Is there a fix for CVE-2026-41714?

Yes. org.springframework.amqp:spring-amqp (Maven): upgrade to 4.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41714 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41714?

Check whether you run org.springframework.amqp:spring-amqp (Maven) or VMware Spring AMQP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41714: VMware Spring AMQP improper certificate validation in RabbitConnectionFactoryBean

CVE-2026-41714 · Severity: medium · CVSS 4 · Published 2026-06-10

Spring AMQP is a library used by Java applications to communicate with message brokers like RabbitMQ. A security issue exists where applications using specific configuration methods may establish encrypted connections without verifying the identity of the server. This could allow an attacker to intercept or view sensitive data transmitted between the application and the message broker.

Technologies: org.springframework.amqp:spring-amqp (Maven), VMware Spring AMQP. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41714 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41714 being exploited in the wild.
How severe is CVE-2026-41714?: Medium severity, with a CVSS score of 4, published 10 June 2026.
Which products and versions are affected?: org.springframework.amqp:spring-amqp (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.4; VMware Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Is there a fix for CVE-2026-41714?: Yes. org.springframework.amqp:spring-amqp (Maven): upgrade to 4.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41714 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41714?: Check whether you run org.springframework.amqp:spring-amqp (Maven) or VMware Spring AMQP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.springframework.amqp:spring-amqp (Maven): upgrade to 4.0.4 or later

# set org.springframework.amqp:spring-amqp to 4.0.4 in your pom.xml or build.gradle

Technical details

A vulnerability in Spring AMQP Core (CWE-295) exists within the RabbitConnectionFactoryBean component. When a developer configures a connection using a URI starting with 'amqps://' via the setUri() method, the library fails to perform mandatory TLS certificate validation and hostname verification unless setUseSSL(true) is explicitly called. This improper certificate validation allows for potential man-in-the-middle (MITM) attacks where an attacker could intercept encrypted traffic. The issue is resolved in versions 4.0.4 and 3.2.11; users on older branches should upgrade to a supported version.

Affected products

Spring Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17

Identifiers

CVE-2026-41714
GHSA-p8qj-fj6r-w7q9

Timeline

2026-06-09: disclosed
2026-06-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.