Medium [CVE-2026-59272] Information disclosure due to disabled TLS hostname verification

Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event.

Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier When configured to ship logs to RabbitMQ over Transport Layer Security (TLS), the appender disables hostname verification by default.

This misconfiguration allows a remote attacker to perform a man-in-the-middle (MITM) attack, intercepting sensitive log events. This can lead to unauthorized information disclosure.

This vulnerability affects the Log4j2 AmqpAppender, a non-default, opt-in component that routes log events to a RabbitMQ broker over AMQP. No Red Hat product enables this appender by default — it requires explicit configuration by the application deployer, making exposure conditional on a deliberate architectural choice.

For Red Hat Enterprise Linux, resteasy packages in RHEL 8 bundle log4j-core as a build-time dependency but do not activate or expose the AMQP Appender at runtime. PKI deployments are not affected unless a custom Log4j2 configuration independently enables the appender.

Exploitation requires the attacker to already hold a man-in-the-middle position on the network path between the logging client and the RabbitMQ broker.