Skip to content
Fencer Vulns
medium 6.8

CVE-2026-59272 json

Log4j2 AmqpAppender disables TLS hostname verification by default

published 2026-08-27 2 mo ago modified 2026-09-01 2 mo ago also EUVD-2026-67093

cvss
6.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Patch / fix

  • vmware spring_advanced_message_queuing_protocol 2.4.19, 3.2.13, 4.0.4.1, 4.1.0.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-59272 updated cvss 6.8

org.apache.logging.log4j/log4j-core: org.springframework.amqp/spring-amqp: Log4j2 AMQP Appender: Information disclosure due to disabled TLS hostname verification

  • Red Hat AI Inference Server rhaii/vllm-gaudi-rhel9, rhaiis/vllm-cuda-rhel9 Red Hat AMQ Broker 7 log4j-core 2.26.0.redhat-00001 Red Hat build of Apache Camel 4 for Quarkus 3 spring-amqp 3.2.9 Red Hat build of Apache Camel for Spring Boot 4 log4j-core 2.26.0.redhat-00001 Red Hat build of Apicurio Registry 3 log4j-core 2.26.0.redhat-00001
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Ceph Storage 6 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Ceph Storage 7 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 8 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +17 more Red Hat Data Grid 8 log4j-core 2.26.0.redhat-00001 Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc Red Hat Enterprise Linux 9 resteasy, pki-resteasy-core, pki-resteasy-client, pki-resteasy-jackson2-provider, pki-resteasy-servlet-initializer Red Hat Enterprise Linux 10 ceph, apache-commons-logging 1.3.4-1.el10
    +1 more products
    Red Hat Enterprise Linux AI (RHEL AI) 3 bazel7 7.7.1-1.el9ai, bazel8 8.6.0-1.el9ai, rhelai3/bootc-gaudi-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Fuse 7 spring-amqp 3.2.9, log4j-core 2.26.0.redhat-00001 Red Hat JBoss Enterprise Application Platform 7 log4j-core 2.26.0.redhat-00001
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat JBoss Web Server 7 jws7-jboss-logging 3.6.2-1.Final_redhat_00001.1.el8jws
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9, rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-th-torch-cpu-py312-rhel9, rhoai/odh-th-torch-cuda-py312-rhel9, rhoai/odh-th06-cpu-torch210-py312-rhel9, +19 more
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

  • Spring Spring AMQP

Classification

Weakness
  • CWE-297 Improper Validation of Certificate with Host Mismatch

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.