CVE-2026-59272: CWE-297 Improper Validation of Certificate with Host Mismatch in Spring Spring AMQP

This vulnerability (CWE-297) in Spring AMQP arises from improper validation of TLS certificates, specifically failing to verify that the certificate's hostname matches the intended RabbitMQ server. Applications shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on default configurations, are susceptible to man-in-the-middle attacks that intercept log data. The affected versions include 2.4.18 and earlier, 3.2.0 through 3.2.12, 4.0.0 through 4.0.4, and 4.1.0. No official remediation or patch is currently documented.

Successful exploitation allows an attacker positioned as a man-in-the-middle to intercept every log event sent over TLS to RabbitMQ, potentially exposing sensitive log data. The vulnerability impacts confidentiality and integrity of log transmissions but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider configuring TLS settings to enforce strict hostname verification or avoid relying on default Log4j2 appender settings that do not validate hostnames properly.