Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 2 vendors · 2 advisories

CVE-2026-59272

CVE-2026-59272: 2 tracked advisory records across Red Hat, VMware. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityMedium6.8

    Medium [CVE-2026-59272] Information disclosure due to disabled TLS hostname verification

    CVE-2026-59272Source published Source updated

    Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interception of every log event. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier When configured to ship logs to RabbitMQ over Transport Layer Security (TLS), the appender disables hostname verification by default. This misconfiguration allows a remote attacker to perform a man-in-the-middle (MITM) attack, intercepting sensitive log events. This can lead to unauthorized information disclosure. This vulnerability affects the Log4j2 AmqpAppender, a non-default, opt-in component that routes log events to a RabbitMQ broker over AMQP. No Red Hat product enables this appender by default — it requires…

    Affected products in this advisory
    • Red Hat AI Inference Server
    • Red Hat AMQ Broker 7
    • Red Hat build of Apache Camel 4 for Quarkus 3
    • Red Hat build of Apache Camel for Spring Boot 4

    17 more entries in the full advisory.

    Source-reported affected versions
    • 4.1.0
    • 4.0.0
    • 4.0.4
    • 3.2.0

    2 more entries in the full advisory.

    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • Disable the Log4j2 AmqpAppender in log4j2.xml if it is not actively required. Where it must remain in use, ensure RabbitMQ is reachable only over a trusted internal network segment, or terminate the TLS connection through a proxy that enforces full certificate chain and hostname validation.
    Full advisory and evidenceOpen source bulletin

VMware

1 advisory

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features