CVE-2026-41701
Received Received - Intake
Predictable Correlation IDs in Spring AMQP

Publication date: 2026-06-10

Last updated on: 2026-06-10

Assigner: VMware

Description
Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-10
Last Modified
2026-06-10
Generated
2026-06-10
AI Q&A
2026-06-10
EPSS Evaluated
N/A
NVD
CVE-2026-41701
EUVD
EUVD-2026-35895
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
vmware spring_amqp From 2.4.0 (inc) to 2.4.17 (inc)
vmware spring_amqp From 3.1.0 (inc) to 3.1.16 (inc)
vmware spring_amqp From 3.2.0 (inc) to 3.2.10 (inc)
vmware spring_amqp From 4.0.0 (inc) to 4.0.3 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-41701 is a security vulnerability in Spring AMQP versions 2.4.0 to 2.4.17, 3.1.0 to 3.1.16, 3.2.0 to 3.2.10, and 4.0.0 to 4.0.3.

The issue involves predictable correlation IDs for replies in the RabbitTemplate.sendAndReceive() method when using fixed reply queues. This predictability is due to an internal simple counter.

Because the correlation IDs are predictable, it can lead to reply poisoning, where an attacker might inject or manipulate replies.

Impact Analysis

This vulnerability can allow an attacker to perform reply poisoning by predicting correlation IDs in the messaging system.

Reply poisoning can lead to unauthorized or malicious replies being accepted by the application, potentially causing data integrity issues or incorrect application behavior.

The overall severity is classified as medium, with a CVSS base score of 4.4, indicating a moderate impact.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Spring AMQP to the fixed versions.

  • Upgrade to version 2.4.18 if you are using the 2.4.x series.
  • Upgrade to version 3.1.16 if you are using the 3.1.x series.
  • Upgrade to version 3.2.11 if you are using the 3.2.x series.
  • Upgrade to version 4.0.4 if you are using the 4.0.x series.

No additional mitigation steps are required beyond upgrading.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41701. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart