TLS validation error

published 2018-09-14 8 y ago modified 2026-06-17 4 mo ago also GHSA-w4g2-9hj6-5472 , EUVD-2018-0705

cvss: 5.9; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits: 0; none known

Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.

Patch / fix

fixed in 3

maven org.springframework.amqp:spring-amqp 1.7.10, 2.0.6
maven com.rabbitmq:amqp-client 4.8.0, 5.4.0
Pivotal Spring AMQP 1.7.10, 2.0.6

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-11087 updated 2025-11-21 cvss 5.3

springframework-amqp: Improper hostname validation

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.23% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub	3.0	5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.springframework.amqp:spring-amqp	>=2.0.0, <2.0.6 <1.7.10	2.0.6 1.7.10
maven	com.rabbitmq:amqp-client	<4.8.0 >=5.0.0, <5.4.0	4.8.0 5.4.0

Affected products

Pivotal Spring AMQP

Classification

Weakness

CWE-295 Improper Certificate Validation

References

pivotal.io /security/cve-2018-11087
web, mitigation, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2018-11087
advisory
github.com /advisories/GHSA-w4g2-9hj6-5472
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary