CVE-2026-40971
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected versions: Spring Boot 4.0.0–4.0.5 (fixed in 4.0.6), 3.5.0–3.5.13 (fixed in 3.5.14).
Risk Assessment
Lack of hostname verification enables man-in-the-middle attacks, potentially leading to interception or modification of communication with the RabbitMQ broker.
Recommendation
Update Spring Boot to version 4.0.6 or 3.5.14 (depending on the branch), which include hostname verification fixes.
Original NVD description (English source)
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.