HeroDevs
Visit NES for Spring Home Page

Spring AMQP 2.3.x Release Notes

5 versions

Comprehensive release notes and changelog for Spring AMQP 2.3.x, including security patches, bug fixes, and feature updates across all supported versions.

Aug 28, 2026
Latest: 2.3.21
7 Patched Vulnerabilities
VEX Statements

August 2026

2.3.21

Released Aug 28, 2026
CVE-2026-59275
CVE-2026-47860
CVE-2026-59272
Full Version: 
2.3.16-spring-amqp-2.3.21

Security Fixes

  • A deeply nested object array can no longer bypass the SerializationUtils deserialization allow-list, which now checks an array's ultimate component type instead of allowing every array, and a resulting StackOverflowError no longer makes the listener container's default error handler exit the JVM (medium severity, CVE-2026-59275).
  • A small compressed message can no longer exhaust the consumer heap, because AbstractDecompressingPostProcessor now bounds how much decompressed body it copies into memory (medium severity, CVE-2026-47860).
  • AmqpAppender.Builder no longer leaves TLS hostname verification disabled when SSL is enabled without an explicit verifyHostname attribute, because that attribute now defaults to true (medium severity, CVE-2026-59272).

Dependency Upgrades

  • Spring Framework (NES) 5.3.39-spring-framework-5.3.54
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.13

June 2026

2.3.20

Released Jun 15, 2026
CVE-2026-41701
CVE-2026-41714
Full Version: 
2.3.16-spring-amqp-2.3.20

Security Fixes

  • Switched RabbitTemplate.sendAndReceive() reply correlation IDs from a predictable AtomicInteger to a UUID, preventing an attacker on a shared reply queue from poisoning or stealing replies destined for another caller (CVE-2026-41701).
  • Fixed RabbitConnectionFactoryBean to enable SSL automatically when an amqps:// URI is configured, so TLS connections are no longer silently established without certificate or hostname verification (CVE-2026-41714).

Dependency Upgrades

  • Spring Framework (NES) 5.3.39-spring-framework-5.3.52
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.12

April 2026

2.3.19

Released Apr 23, 2026
CVE-2023-34050
Full Version: 
2.3.16-spring-amqp-2.3.19

Security Fixes

  • This patches the Java deserialization vulnerability in Spring AMQP (CVE-2023-34050). SerializationUtils.checkAllowedList(...) no longer permits deserialization when no allowed class name patterns are configured, and throws a SecurityException instead.

Dependency Upgrades

  • Spring Framework (NES) 5.3.39-spring-framework-5.3.51
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.11

March 2026

2.3.18

Released Mar 25, 2026
Full Version: 
2.3.16-spring-amqp-2.3.18

Dependency Upgrades

  • Spring Framework (NES) 5.3.39-spring-framework-5.3.50
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.10

2.3.17

Released Mar 11, 2026
Full Version: 
2.3.16-spring-amqp-2.3.17

Notes

  • This release originates from the open‑source Spring AMQP repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring AMQP 2.3.16.

Dependency Upgrades

  • Spring Framework (NES) 5.3.39-spring-framework-5.3.49
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.9

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.