CVE-2026-59272

MediumCVSS 6.8/10Last modified Sep 1, 2026

Description

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-297

Affected software

Vendor	Product	Versions
Spring	Spring AMQP	4.1.0; >= 4.0.0, <= 4.0.4; >= 3.2.0, <= 3.2.12; <= 2.4.18

References

https://spring.io/security/cve-2026-59272Vendor Advisory

Timeline

Published: Aug 27, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-592746.5The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zi CVE-2026-592754.9A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss CVE-2026-592765.9Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a const CVE-2026-592775.3Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher t CVE-2026-592786.5JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — wh CVE-2026-592797.5The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by CVE-2026-59287.5Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and CVE-2026-592804.3Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view n CVE-2026-592816.1Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using CVE-2026-592827.5Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may b CVE-2026-592839.1Applications that evaluate Spring Expression Language (SpEL) expressions using SimpleEvaluationContext may be vulnerable to a safety guard b CVE-2026-592847.6There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commons 5.0.0 - 5.0.2 Spr