CVE-2026-41701: In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41701?
CVE-2026-41701 has a severity rating of medium with a score of 4.4.
What is the risk of CVE-2026-41701?
The risk associated with CVE-2026-41701 is categorized as 28.
How do I fix CVE-2026-41701?
To fix CVE-2026-41701, upgrade to a non-vulnerable version of Spring AMQP higher than 4.0.3, 3.2.10, 3.1.15, or 2.4.17.
What versions are affected by CVE-2026-41701?
CVE-2026-41701 affects Spring AMQP versions 4.0.0 through 4.0.3, 3.2.0 through 3.2.10, 3.1.0 through 3.1.15, and 2.4.0 through 2.4.17.
What is the impact of CVE-2026-41701?
The impact of CVE-2026-41701 includes the potential for reply poisoning due to predictable correlation IDs in fixed reply queues.