CVE-2026-41701

Awaiting Analysis Awaiting Analysis - Queue

Predictable Correlation IDs in Spring AMQP

Publication date: 2026-06-10

Last updated on: 2026-06-23

Assigner: VMware

Description

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-10

Last Modified

2026-06-23

Generated

2026-06-30

AI Q&A

2026-06-10

EPSS Evaluated

2026-06-29

NVD

CVE-2026-41701

EUVD

EUVD-2026-35895

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_amqp	From 2.4.0 (inc) to 2.4.17 (inc)
vmware	spring_amqp	From 3.1.0 (inc) to 3.1.16 (inc)
vmware	spring_amqp	From 3.2.0 (inc) to 3.2.10 (inc)
vmware	spring_amqp	From 4.0.0 (inc) to 4.0.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-330	The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Attack-Flow Graph

Executive Summary

CVE-2026-41701 is a security vulnerability in Spring AMQP versions 2.4.0 to 2.4.17, 3.1.0 to 3.1.16, 3.2.0 to 3.2.10, and 4.0.0 to 4.0.3.

The issue involves predictable correlation IDs for replies in the RabbitTemplate.sendAndReceive() method when using fixed reply queues. This predictability is due to an internal simple counter.

Because the correlation IDs are predictable, it can lead to reply poisoning, where an attacker might inject or manipulate replies.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Impact Analysis

This vulnerability can allow an attacker to perform reply poisoning by predicting correlation IDs in the messaging system.

Reply poisoning can lead to unauthorized or malicious replies being accepted by the application, potentially causing data integrity issues or incorrect application behavior.

The overall severity is classified as medium, with a CVSS base score of 4.4, indicating a moderate impact.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Spring AMQP to the fixed versions.

Upgrade to version 2.4.18 if you are using the 2.4.x series.
Upgrade to version 3.1.16 if you are using the 3.1.x series.
Upgrade to version 3.2.11 if you are using the 3.2.x series.
Upgrade to version 4.0.4 if you are using the 4.0.x series.

No additional mitigation steps are required beyond upgrading.

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Hi! I’m here to help you understand CVE-2026-41701. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70