# CVE-2026-41714: VMware Spring AMQP improper certificate validation in RabbitConnectionFactoryBean

Source: https://junglewise.ai/threats/cve-2026-41714-vmware-spring-amqp-improper-certificate-validation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-41714 · Severity: medium · CVSS 4 · Published 2026-06-10

Spring AMQP is a library used by Java applications to communicate with message brokers like RabbitMQ. A security issue exists where applications using specific configuration methods may establish encrypted connections without verifying the identity of the server. This could allow an attacker to intercept or view sensitive data transmitted between the application and the message broker.

Technologies: [org.springframework.amqp:spring-amqp (Maven)](https://junglewise.ai/threats/technologies/org-springframework-amqp-spring-amqp), [VMware Spring AMQP](https://junglewise.ai/threats/technologies/spring-amqp). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41714 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41714 being exploited in the wild.

**How severe is CVE-2026-41714?** Medium severity, with a CVSS score of 4, published 10 June 2026.

**Which products and versions are affected?** org.springframework.amqp:spring-amqp (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.4; VMware Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

**Is there a fix for CVE-2026-41714?** Yes. org.springframework.amqp:spring-amqp (Maven): upgrade to 4.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41714 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41714?** Check whether you run org.springframework.amqp:spring-amqp (Maven) or VMware Spring AMQP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.amqp:spring-amqp (Maven): upgrade to 4.0.4 or later

  ```sh
  # set org.springframework.amqp:spring-amqp to 4.0.4 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability in Spring AMQP Core (CWE-295) exists within the RabbitConnectionFactoryBean component. When a developer configures a connection using a URI starting with 'amqps://' via the setUri() method, the library fails to perform mandatory TLS certificate validation and hostname verification unless setUseSSL(true) is explicitly called. This improper certificate validation allows for potential man-in-the-middle (MITM) attacks where an attacker could intercept encrypted traffic. The issue is resolved in versions 4.0.4 and 3.2.11; users on older branches should upgrade to a supported version.

## Affected products

- Spring Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17

## Identifiers

- CVE-2026-41714
- GHSA-p8qj-fj6r-w7q9

## Timeline

- 2026-06-09: disclosed
- 2026-06-10: advisory

## References

- [https://spring.io/security/cve-2026-41714](https://spring.io/security/cve-2026-41714)
- [https://github.com/spring-projects/spring-amqp/releases/tag/v3.2.11](https://github.com/spring-projects/spring-amqp/releases/tag/v3.2.11)
- [https://github.com/spring-projects/spring-amqp/releases/tag/v4.0.4](https://github.com/spring-projects/spring-amqp/releases/tag/v4.0.4)

## Related threats

- [Spring AMQP malicious message denial of service](https://junglewise.ai/threats/cve-2026-59275-spring-amqp-malicious-message-denial-of-service)
- [Spring AMQP RabbitMQ management password disclosure in exception message](https://junglewise.ai/threats/cve-2026-59271-spring-amqp-rabbitmq-management-password-disclosure-in-exception)
- [VMware Spring AMQP predictable Correlation IDs in RabbitTemplate](https://junglewise.ai/threats/cve-2026-41701-vmware-spring-amqp-predictable-correlation-ids-in-rabbittemplate)
- [Deserialization of Untrusted Data in Spring AMQP](https://junglewise.ai/threats/cve-2021-22097-deserialization-of-untrusted-data-in-spring-amqp)
- [Deserialization of Untrusted Data in Spring AMQP](https://junglewise.ai/threats/cve-2017-8045-deserialization-of-untrusted-data-in-spring-amqp)