CVE-2026-40971 is a TLS hostname verification gap in Spring Boot, scored CVSS 5.0. When RabbitMQ auto configuration uses an SSL bundle, the client does not verify the broker hostname. Upgrade to Spring Boot 4.0.6 or 3.5.14. The fix is a patch release on each supported line.
What's affected
From the Spring security advisory dated 2026-04-23, rated medium:
- Spring Boot 4.0.0 through 4.0.5, fixed in 4.0.6
- Spring Boot 3.5.0 through 3.5.13, fixed in 3.5.14
Both fixes are listed as open source releases. The advisory says no further mitigation steps are needed after upgrading. The issue applies when RabbitMQ is configured through an SSL bundle.
How to check if you're exposed
Find the Spring Boot version in your build. For Maven:
mvn dependency:tree -Dincludes=org.springframework.boot:spring-boot
For Gradle:
./gradlew dependencies --configuration runtimeClasspath | grep spring-boot
Then check whether your application configures RabbitMQ with an SSL bundle. Look in application properties or YAML for spring.rabbitmq.ssl.bundle.
What to do now
- Upgrade to Spring Boot 4.0.6 or 3.5.14 or later on your line.
- Search configuration for spring.rabbitmq.ssl.bundle to see which services use it.
- Prioritize services whose broker connection crosses a network you do not control.
- Redeploy and confirm the version in the running artifact.
Why it matters
The weakness is CWE-295, improper certificate validation. TLS proves two things: the channel is encrypted, and the server is the host you asked for. Without hostname verification, only the first holds, so a different server with a certificate your client trusts could answer.
The CVSS vector is adjacent network with high complexity, which explains the medium score. An attacker needs a position on the path to the broker. Messaging traffic often carries business data, so close the gap in services that leave your private network. The record does not flag exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this the same as CVE-2026-40974?
It is the same kind of issue in a different component. CVE-2026-40974 concerns Cassandra auto configuration. Both were fixed in the same Spring Boot releases.
Sources
Last reviewed: 19 October 2026.
