The vulnerability CVE-2026-41701 in Spring AMQP arises from the use of insufficiently random values for correlation IDs in the RabbitTemplate.sendAndReceive() method when using a fixed reply queue. Specifically, the correlation IDs are generated using a simple internal counter, making them predictable. This affects versions 4.0.0 through 4.0.3, 3.2.0 through 3.2.10, 3.1.0 through 3.1.15, and 2.4.0 through 2.4.17 of Spring AMQP. The CVSS v3.1 base score is 4.4 (medium severity), with network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact. There is no known exploit in the wild and no vendor-provided patch or official remediation at this time.

The predictability of correlation IDs can allow an attacker with high privileges and network access to potentially correlate or interfere with message replies, leading to partial confidentiality and integrity impacts. However, the attack complexity is high and requires privileges, limiting the ease of exploitation. There is no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider avoiding the use of fixed reply queues with RabbitTemplate.sendAndReceive() or implement additional application-level randomness or correlation ID management to mitigate predictability.