VMware Spring Advanced Message Queuing Protocol vulnerabilities

11 CVEs affecting VMware Spring Advanced Message Queuing Protocol, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59320, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-2173, published 2017-04-21. Critical severity, CVSS 9.8. EPSS: 6.3% chance of exploitation in the next 30 days. org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
CVE-2023-34050, published 2023-10-19. Medium severity, CVSS 4.3. EPSS: 1.5% chance of exploitation in the next 30 days. In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization…
CVE-2021-22097, published 2021-10-28. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type…
CVE-2021-22095, published 2021-11-30. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size.…
CVE-2026-59275, published 2026-08-27. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP…
CVE-2026-59320, published 2026-08-27. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default…
CVE-2026-47860, published 2026-08-27. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 -…
CVE-2026-59271, published 2026-08-27. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP…
CVE-2026-59272, published 2026-08-27. Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days. Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP…
CVE-2026-41701, published 2026-06-10. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3;…

Latest

CVE-2026-41714, published 2026-06-10. Medium severity, CVSS 4.0. EPSS: 0.2% chance of exploitation in the next 30 days. Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no…