PT-2026-35539 · Vmware+1 · Spring Boot+1

Published 2026-04-27 · Updated 2026-05-17 · CVE-2026-40971

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5 Spring Boot versions 3.5.0 through 3.5.13

Description When configured to use an SSL bundle, the RabbitMQ auto-configuration fails to perform hostname verification during the connection process to the RabbitMQ broker.

Recommendations Update to version 4.0.6 Update to version 3.5.14

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-40971

GHSA-9VC8-QPPQ-WVXC

Affected Products

Rabbitmq

Spring Boot

References · 7

• https://spring.io/security/cve-2026-40971 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40971 · Security Note
• https://osv.dev/vulnerability/GHSA-9vc8-qppq-wvxc · Vendor Advisory
• https://github.com/spring-projects/spring-boot · Note
• https://twitter.com/CVEnew/status/2048910083418145274 · Twitter Post
• https://twitter.com/f1tym1/status/2055931205963382812 · Twitter Post
• https://twitter.com/threatcluster/status/2048832252293861552 · Twitter Post