CVE-2026-59272 — Log4j2 AmqpAppender disables TLS hostname verification by default

CVE-2026-59272

Log4j2 AmqpAppender disables TLS hostname verification by default PUBLISHED

Description (CNA)

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Spring AMQP	affected 4.1.0; affected 4.0.0 through 4.0.4; affected 3.2.0 through 3.2.12; affected 0 through 2.4.18

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-59272

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.