Executive brief
Spring AMQP is a messaging library used by applications to send logs and events to RabbitMQ message brokers. When configured with TLS encryption, the library fails to properly validate server certificates by default, allowing an attacker on the network to intercept, read, and potentially modify all log events in transit. This exposes sensitive information contained in application logs to eavesdropping.
Technical details
The vulnerability is a TLS certificate validation bypass in Spring AMQP's RabbitMQ appender. Applications using Log4j2 with Spring AMQP to ship logs over TLS rely on documented defaults that disable proper certificate verification, leaving TLS connections vulnerable to man-in-the-middle (MITM) attacks. No authentication is required—any attacker positioned on the network path between the application and RabbitMQ broker can intercept encrypted log traffic. The affected versions include Spring AMQP 2.4.18 and earlier, 3.2.0–3.2.12, 4.0.0–4.0.4, and 4.1.0. Patches are expected to enforce certificate validation by default.
Affected products
- Spring AMQP 2.4.18 and earlier, 3.2.0–3.2.12, 4.0.0–4.0.4, 4.1.0
Timeline
- 2026-08-27: disclosed