EXPOSURES › CVE-2026-40971

CVE-2026-40971

MEDIUM

DETAIL

SourceNVD · cve Published2026-04-27 CVSS5.0 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-40971 ↗

▸ RECOMMENDED ACTION Patch the affected products and confirm your instances are covered.

PLAYERS IMPLICATED

VMware, Inc. · vendor spring boot · product

DESCRIPTION

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14) per vendor advisory.

AFFECTED FEDRAMP PRODUCTS · 2

PRODUCT	PROVIDER	STATUS	MATCH
VMware Government Services (VGS) VMware, Inc.	VMware, Inc.	Authorized	vendor-exact · 0.90
Workspace ONE VMware, Inc.	VMware, Inc.	Authorized	vendor-exact · 0.90