# org.springframework.amqp:spring-amqp (Maven) vulnerabilities

7 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.springframework.amqp/spring-amqp

## Advisories (7)

### [CVE-2026-41714](https://cve.now/CVE-2026-41714): In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

- Severity: Medium 4.0
- Published: Jun 9, 2026
- Affected: from 4.0.0, fixed in 4.0.4; from 3.2.0, fixed in 3.2.11; from 3.1.0, through 3.1.15; through 2.4.17.

### [CVE-2026-41701](https://cve.now/CVE-2026-41701): In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues

- Severity: Medium 4.4
- Published: Jun 9, 2026
- Affected: from 4.0.0, fixed in 4.0.4; from 3.2.0, fixed in 3.2.11; from 3.1.0, through 3.1.15; through 2.4.17.

### [CVE-2021-22095](https://cve.now/CVE-2021-22095): In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new…

- Severity: Unrated
- Published: Nov 30, 2021
- Affected: from 2.2.0, fixed in 2.2.20; from 2.3.0, fixed in 2.3.11.

### [CVE-2021-22097](https://cve.now/CVE-2021-22097): In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a…

- Severity: Unrated
- Published: Oct 28, 2021
- Affected: from 2.2.0, fixed in 2.2.19; from 2.3.0, fixed in 2.3.11.

### [CVE-2018-11087](https://cve.now/CVE-2018-11087): TLS validation error

- Severity: Unrated
- Published: Sep 14, 2018
- Affected: from 2.0.0, fixed in 2.0.6; fixed in 1.7.10.

### [CVE-2017-8045](https://cve.now/CVE-2017-8045): In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized…

- Severity: Unrated
- Published: Nov 27, 2017
- Affected: fixed in 1.5.7; from 1.6.0, fixed in 1.6.11; from 1.7.0, fixed in 1.7.4.

### [CVE-2016-2173](https://cve.now/CVE-2016-2173): org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.

- Severity: Unrated
- Published: Apr 21, 2017
- Affected: fixed in 1.5.5.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.springframework.amqp:spring-amqp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.