CVE-2026-41701: In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.
Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable sequential correlation IDs (do not use the internal simple counter) to avoid predictable correlation IDs that enable reply poisoning when using a fixed reply queue.
Spring AMQP (RabbitTemplate.sendAndReceive) sequential correlation IDs = disabled - Configuration
Avoid using a fixed reply queue for sendAndReceive; do not rely on a fixed reply queue where correlation IDs are predictable.
Spring AMQP (RabbitTemplate.sendAndReceive) use fixed reply queue = avoid / false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41701?
CVE-2026-41701 has a severity rating of medium with a score of 4.4.
What is the risk of CVE-2026-41701?
The risk associated with CVE-2026-41701 is categorized as 28.
How do I fix CVE-2026-41701?
To fix CVE-2026-41701, upgrade to a non-vulnerable version of Spring AMQP higher than 4.0.3, 3.2.10, 3.1.15, or 2.4.17.
What versions are affected by CVE-2026-41701?
CVE-2026-41701 affects Spring AMQP versions 4.0.0 through 4.0.3, 3.2.0 through 3.2.10, 3.1.0 through 3.1.15, and 2.4.0 through 2.4.17.
What is the impact of CVE-2026-41701?
The impact of CVE-2026-41701 includes the potential for reply poisoning due to predictable correlation IDs in fixed reply queues.