CVE-2026-59320
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Affects Spring AMQP 4.1.0.
Risk Assessment
The risk includes complete halt of message processing, which could lead to application downtime and message loss. This may result in service unavailability and business continuity issues.
Recommendation
It is recommended to upgrade Spring AMQP to a patched version. Also monitor link credit status and implement alerting mechanisms for potential stalls.
Other vulnerabilities in Spring AMQP
See all- CVE-2016-2173Critical
Versions of Spring AMQP before 1.5.5 contain a vulnerability in the org.springframework.core.serializer.DefaultDeserializer class that allows remote attackers to execute arbitrary code.
- CVE-2026-59272Medium
Applications shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, are exposed to man-in-the-middle interception of every log event. Affected Spring AMQP versions: 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-59275Medium
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Affected versions: Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-59271Medium
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Affected versions: Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-47860Medium
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Affects Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.
- CVE-2026-41714Medium
In Spring AMQP, applications configuring broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without calling setUseSSL(true) get TLS encryption with no certificate validation and no hostname verification.
- CVE-2026-41701Medium
Vulnerability in Spring AMQP causes correlation IDs for replies in RabbitTemplate.sendAndReceive() with fixed reply queue to be predictable due to an internal simple counter. Affects Spring AMQP versions 4.0.0-4.0.3, 3.2.0-3.2.10, 3.1.0-3.1.15, and 2.4.0-2.4.17.
Original NVD description (English source)
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0
Vulnerability data from NVD (NIST) · CISA KEV · EPSS