WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor org.springframework.amqp✕Product spring-amqp✕
Overview 7 matches · 4 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
7matches 4protected57.1% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 4 57.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 42.9% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 2 28.6% High 0 0.0% Medium 5 71.4% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 57.1% partly blocked 0 0.0% not blocked 3 42.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 100.0%
split by peak 2 / year
No exploit published: 3Protected by Waratek: 4 Medium: 5Critical: 2 not blocked: 3blocked by ARMR today: 4 No public exploit: 7
20172 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2 20181 No exploit published1 Medium1 not blocked1 No public exploit1 20190 20200 20212 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20220 20230 20240 20250 20262 No exploit published2 Medium2 not blocked2 No public exploit2
2017201820192020202120222023202420252026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-41714 Medium 2026-06-10 No exploit published No public exploit Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
CVE-2026-41701 Medium 2026-06-10 No exploit published No public exploit Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.
CVE-2021-22095 Medium 2021-11-30 Protected by Waratek No public exploit In Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message
CVE-2021-22097 Medium 2021-10-28 Protected by Waratek No public exploit In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.
CVE-2018-11087 Medium 2018-09-14 No exploit published No public exploit Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
CVE-2017-8045 Critical 2017-11-27 Protected by Waratek No public exploit In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.
CVE-2016-2173 Critical 2017-04-21 Protected by Waratek No public exploit org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.