GHSA-p5f7-rjhp-pxvc

Source

https://github.com/advisories/GHSA-p5f7-rjhp-pxvc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-p5f7-rjhp-pxvc/GHSA-p5f7-rjhp-pxvc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p5f7-rjhp-pxvc

Aliases

CVE-2026-41701

Published

2026-06-10T00:31:51Z

Modified

2026-08-12T16:41:04Z

Severity

4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

Details

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

Database specific

{
    "cwe_ids":  [
        "CWE-330"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-12T16:21:49Z",
    "nvd_published_at":  "2026-06-10T00:16:51Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven

org.springframework.amqp:spring-amqp

Package

Name: org.springframework.amqp:spring-amqp; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.amqp/spring-amqp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

4.0.4

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

Database specific

last_known_affected_version_range

"<= 4.0.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-p5f7-rjhp-pxvc/GHSA-p5f7-rjhp-pxvc.json"

org.springframework.amqp:spring-amqp

Package

Name: org.springframework.amqp:spring-amqp; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.amqp/spring-amqp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.2.0

Fixed

3.2.11

Affected versions

3.*

3.2.0

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.2.6

3.2.7

3.2.8

3.2.9

3.2.10

Database specific

last_known_affected_version_range

"<= 3.2.10"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-p5f7-rjhp-pxvc/GHSA-p5f7-rjhp-pxvc.json"

org.springframework.amqp:spring-amqp

Package

Name: org.springframework.amqp:spring-amqp; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.amqp/spring-amqp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.1.0

Last Affected

3.1.15

Affected versions

3.*

3.1.0

3.1.1

3.1.2

3.1.3

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

3.1.10

3.1.11

3.1.12

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-p5f7-rjhp-pxvc/GHSA-p5f7-rjhp-pxvc.json"

org.springframework.amqp:spring-amqp

Package

Name: org.springframework.amqp:spring-amqp; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.amqp/spring-amqp

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

2.4.17

Affected versions

1.*

1.0.0.RELEASE

1.1.0.RELEASE

1.1.1.RELEASE

1.1.2.RELEASE

1.1.3.RELEASE

1.1.4.RELEASE

1.2.0.RELEASE

1.2.1.RELEASE

1.2.2.RELEASE

1.3.0.RELEASE

1.3.1.RELEASE

1.3.2.RELEASE

1.3.3.RELEASE

1.3.4.RELEASE

1.3.5.RELEASE

1.3.6.RELEASE

1.3.7.RELEASE

1.3.8.RELEASE

1.3.9.RELEASE

1.4.0.RELEASE

1.4.1.RELEASE

1.4.2.RELEASE

1.4.3.RELEASE

1.4.4.RELEASE

1.4.5.RELEASE

1.4.6.RELEASE

1.5.0.RELEASE

1.5.1.RELEASE

1.5.2.RELEASE

1.5.3.RELEASE

1.5.4.RELEASE

1.5.5.RELEASE

1.5.6.RELEASE

1.5.7.RELEASE

1.6.0.RELEASE

1.6.1.RELEASE

1.6.2.RELEASE

1.6.3.RELEASE

1.6.4.RELEASE

1.6.5.RELEASE

1.6.6.RELEASE

1.6.7.RELEASE

1.6.8.RELEASE

1.6.9.RELEASE

1.6.10.RELEASE

1.6.11.RELEASE

1.7.0.RELEASE

1.7.1.RELEASE

1.7.2.RELEASE

1.7.3.RELEASE

1.7.4.RELEASE

1.7.5.RELEASE

1.7.6.RELEASE

1.7.7.RELEASE

1.7.8.RELEASE

1.7.9.RELEASE

1.7.10.RELEASE

1.7.11.RELEASE

1.7.12.RELEASE

1.7.13.RELEASE

1.7.14.RELEASE

1.7.15.RELEASE

2.*

2.0.0.RELEASE

2.0.1.RELEASE

2.0.2.RELEASE

2.0.3.RELEASE

2.0.4.RELEASE

2.0.5.RELEASE

2.0.6.RELEASE

2.0.7.RELEASE

2.0.8.RELEASE

2.0.9.RELEASE

2.0.10.RELEASE

2.0.11.RELEASE

2.0.12.RELEASE

2.0.13.RELEASE

2.0.14.RELEASE

2.1.0.RELEASE

2.1.1.RELEASE

2.1.2.RELEASE

2.1.3.RELEASE

2.1.4.RELEASE

2.1.5.RELEASE

2.1.6.RELEASE

2.1.7.RELEASE

2.1.8.RELEASE

2.1.9.RELEASE

2.1.10.RELEASE

2.1.11.RELEASE

2.1.12.RELEASE

2.1.13.RELEASE

2.1.14.RELEASE

2.1.15.RELEASE

2.1.16.RELEASE

2.1.17.RELEASE

2.1.18.RELEASE

2.2.0.RELEASE

2.2.1.RELEASE

2.2.2.RELEASE

2.2.3.RELEASE

2.2.4.RELEASE

2.2.5.RELEASE

2.2.6.RELEASE

2.2.7.RELEASE

2.2.8.RELEASE

2.2.9.RELEASE

2.2.10.RELEASE

2.2.11.RELEASE

2.2.12.RELEASE

2.2.13.RELEASE

2.2.14.RELEASE

2.2.15.RELEASE

2.2.16.RELEASE

2.2.17.RELEASE

2.2.18.RELEASE

2.2.19.RELEASE

2.2.20.RELEASE

2.2.21.RELEASE

2.2.22.RELEASE

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5

2.3.6

2.3.7

2.3.8

2.3.9

2.3.10

2.3.11

2.3.12

2.3.13

2.3.14

2.3.15

2.3.16

2.4.0

2.4.1

2.4.2

2.4.3

2.4.4

2.4.5

2.4.6

2.4.7

2.4.8

2.4.9

2.4.10

2.4.11

2.4.12

2.4.13

2.4.14

2.4.15

2.4.16

2.4.17

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-p5f7-rjhp-pxvc/GHSA-p5f7-rjhp-pxvc.json"