CVE-2026-59275
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Affected versions: Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
Risk Assessment
The risk is the possibility of a DoS attack that can stop the entire application, causing service disruptions.
Recommendation
It is recommended to update Spring AMQP to the latest available version and monitor AMQP messages for malicious content.
Other vulnerabilities in Spring AMQP
See all- CVE-2016-2173Critical
Versions of Spring AMQP before 1.5.5 contain a vulnerability in the org.springframework.core.serializer.DefaultDeserializer class that allows remote attackers to execute arbitrary code.
- CVE-2026-59320Medium
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Affects Spring AMQP 4.1.0.
- CVE-2026-59272Medium
Applications shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, are exposed to man-in-the-middle interception of every log event. Affected Spring AMQP versions: 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-59271Medium
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Affected versions: Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-47860Medium
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Affects Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-41714Medium
In Spring AMQP, applications configuring broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
- CVE-2026-41701Medium
Vulnerability in Spring AMQP causes correlation IDs for replies in RabbitTemplate.sendAndReceive() with fixed reply queue to be predictable due to an internal simple counter. Affects Spring AMQP versions 4.0.0-4.0.3, 3.2.0-3.2.10, 3.1.0-3.1.15, and 2.4.0-2.4.17.
Original NVD description (English source)
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier