It is my pleasure today to share with you the Spring AMQP 4.1.0 is available with some new features and CVE fixes.

Notable changes in this release:

• All the dependencies upgaded to their latest major/minor versions.
• Generic AMQP 1.0 support via dedicated spring-amqp-client module based on ProtonJ 2.
• Compatibility with RabbitMQ 4.3.
• The SimpleMessageListenerContainer provides option for immediate scale-down on dynamic consumers.
• The JSON converters now "trust no one" by default.

Use * for trsustedPackages property to opt-in to the previous "trust all" behavior.

See the Release Notes and What's New for more information.

In addition, the Spring AMQP 3.2.11 & 4.0.4 with bug and CVE fixes are available.

CVEs fixed in this release

• CVE-2026-41701: Sequential correlation IDs enable reply poisoning on fixed reply queues
• CVE-2026-41714: The RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

Cheers, 
Artem

Project Page | GitHub Issues | Contributing | Help