Any application shipping logs through Log4j2 AmqpAppender to RabbitMQ over TLS uses a default configuration that disables hostname verification. This weakness, identified as CWE-295 and CWE-297, allows an attacker to perform a man‑in‑the‑middle interception of every log event, compromising the confidentiality and integrity of the transmitted data. The vulnerability stems from improper certificate validation and hostname verification.

Spring AMQP 4.1.0, Spring AMQP 4.0.0–4.0.4, Spring AMQP 3.2.0–3.2.12, and all Spring AMQP 2.4.18 or earlier are affected.

The CVSS score of 6.8 indicates a medium severity vulnerability. The EPSS score of < 1% indicates a very low exploitation probability, and the issue is not listed in CISA’s KEV catalog. An attacker would need to position themselves between the application and the RabbitMQ broker to intercept log events, exploiting the Log4j2 configuration during TLS communication. However, given the low EPSS score, the likelihood of such exploitation in the wild is very low.