CVE-2026-41701: Spring AMQP Has Predictable Correlation IDs in RabbitTemplate.sendAndReceive() with Fixed Reply Queue

June 10, 2026 (updated August 12, 2026)

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter.

Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1.0 through 3.1.15; 2.4.0 through 2.4.17.

References

github.com/advisories/GHSA-p5f7-rjhp-pxvc
github.com/spring-projects/spring-amqp/releases/tag/v3.2.11
github.com/spring-projects/spring-amqp/releases/tag/v4.0.4
nvd.nist.gov/vuln/detail/CVE-2026-41701
spring.io/security/cve-2026-41701

Code Behaviors & Features

Detect and mitigate CVE-2026-41701 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →