Spring AMQP 3.2.x Release Notes

Security Fixes

• A deeply nested object array can no longer bypass the SerializationUtils deserialization allow-list, which now checks an array's ultimate component type instead of allowing every array, and a resulting StackOverflowError no longer makes the listener container's default error handler exit the JVM (medium severity, CVE-2026-59275).
• A failed RabbitMQ management aliveness check no longer includes the configured administrator password in the exception message raised by BrokerRunningSupport (medium severity, CVE-2026-59271).
• A small compressed message can no longer exhaust the consumer heap, because AbstractDecompressingPostProcessor now bounds how much decompressed body it copies into memory (medium severity, CVE-2026-47860).
• AmqpAppender.Builder no longer leaves TLS hostname verification disabled when SSL is enabled without an explicit verifyHostname attribute, because that attribute now defaults to true (medium severity, CVE-2026-59272).

Dependency Upgrades

• Spring Data BOM (NES) 2024.1.13-spring-data-bom-2024.1.18
• Spring Framework (NES) 6.2.19-spring-framework-6.2.21
• Spring Retry (NES) 2.0.13-spring-retry-2.0.15