HeroDevs
Visit NES for Spring Home Page

Spring AMQP 2.4.x Release Notes

11 versions

Comprehensive release notes and changelog for Spring AMQP 2.4.x, including security patches, bug fixes, and feature updates across all supported versions.

Aug 28, 2026
Latest: 2.4.28
7 Patched Vulnerabilities
VEX Statements

August 2026

2.4.28

Released Aug 28, 2026
CVE-2026-59275
CVE-2026-47860
CVE-2026-59272
Full Version: 
2.4.17-spring-amqp-2.4.28

Security Fixes

  • A deeply nested object array can no longer bypass the SerializationUtils deserialization allow-list, which now checks an array's ultimate component type instead of allowing every array, and a resulting StackOverflowError no longer makes the listener container's default error handler exit the JVM (medium severity, CVE-2026-59275).
  • A small compressed message can no longer exhaust the consumer heap, because AbstractDecompressingPostProcessor now bounds how much decompressed body it copies into memory (medium severity, CVE-2026-47860).
  • AmqpAppender.Builder no longer leaves TLS hostname verification disabled when SSL is enabled without an explicit verifyHostname attribute, because that attribute now defaults to true (medium severity, CVE-2026-59272).

Dependency Upgrades

  • Spring Data Commons (NES) 2.7.18-spring-data-commons-2.7.28
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.54
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.13

June 2026

2.4.27

Released Jun 15, 2026
CVE-2026-41701
CVE-2026-41714
Full Version: 
2.4.17-spring-amqp-2.4.27

Security Fixes

  • Switched RabbitTemplate.sendAndReceive() reply correlation IDs from a predictable AtomicInteger to a UUID, preventing an attacker on a shared reply queue from poisoning or stealing replies destined for another caller (CVE-2026-41701).
  • Fixed RabbitConnectionFactoryBean to enable SSL automatically when an amqps:// URI is configured, so TLS connections are no longer silently established without certificate or hostname verification (CVE-2026-41714).

Dependency Upgrades

  • Spring Data Commons (NES) 2.7.18-spring-data-commons-2.7.27
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.52
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.12

April 2026

2.4.26

Released Apr 23, 2026
Full Version: 
2.4.17-spring-amqp-2.4.26

Dependency Upgrades

  • Spring Data Commons (NES) 2.7.18-spring-data-commons-2.7.26
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.51
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.11

March 2026

2.4.25

Released Mar 25, 2026
Full Version: 
2.4.17-spring-amqp-2.4.25

Dependency Upgrades

  • Spring Data Commons (NES) 2.7.18-spring-data-commons-2.7.25
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.50
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.10

October 2025

2.4.24

Released Oct 23, 2025
Full Version: 
2.4.17-spring-amqp-2.4.24

Dependency Upgrades

  • Spring Data Commons (NES) 2.7.18-spring-data-commons-2.7.24
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.49

September 2025

2.4.23

Released Sep 30, 2025
Full Version: 
2.4.17-spring-amqp-2.4.23

Dependency Upgrades

  • Spring Retry (NES) 1.3.4-spring-retry-1.3.8

2.4.22

Released Sep 23, 2025
Full Version: 
2.4.17-spring-amqp-2.4.22

Dependency Upgrades

  • Spring Data Commons (NES) 2.7.18-spring-data-commons-2.7.23
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.48

August 2025

2.4.21

Released Aug 25, 2025
Full Version: 
2.4.17-spring-amqp-2.4.21

Dependency Upgrades

  • Spring Data Commons (NES) 2.7.18-spring-data-commons-2.7.22
  • Spring Framework (NES) 5.3.39-spring-framework-5.3.47
  • Spring Retry (NES) 1.3.4-spring-retry-1.3.8

May 2025

2.4.20

Released May 19, 2025
Full Version: 
2.4.17-spring-amqp-2.4.20

Dependency Upgrades

  • Spring Framework (NES): 5.3.39-spring-framework-5.3.46

*Full Version: 2.4.17-spring-amqp-2.4.20

February 2025

2.4.19

Released Feb 24, 2025
Full Version: 
2.4.17-spring-amqp-2.4.19

Notes

  • Publish Spring AMQP under the org.springframework.amqp group ID instead of com.herodevs.nes.springframework.amqp

Dependency Upgrades

  • Spring Data Commons (NES): 2.7.18-spring-data-commons-2.7.20
  • Spring Framework (NES): 5.3.39-spring-framework-5.3.45
  • Spring Retry (NES): 1.3.4-spring-retry-1.3.6

November 2024

2.4.18

Released Nov 15, 2024
Full Version: 
2.4.17-spring-amqp-2.4.18

Notes

  • This release originates from the open‑source Spring AMQP repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring AMQP build 2.4.17. Full Version: 2.4.17-spring-amqp-2.4.18

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.