← Vulnerability feed

Vulnerability record · CVE-2026-59320 · published 27 August 2026

CVE-2026-59320: Vmware spring advanced message queuing protocol vulnerability

Vmware · Spring Advanced Message Queuing Protocol

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0

6.5 CVSS 3.1 Medium EPSS 0.42% · top 66.2% CWE-772 · CWE-772
6.5CVSS 3.1 base score
0.42%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
31 Aug 2026Last modified by NVD

Description

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://spring.io/security/cve-2026-59320 Vendor Advisory

Track CVE-2026-59320 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2016-2173Fedoraproject fedora improper input validation vulnerabilityorg.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.EPSS 6.3%6.8CVE-2026-59272Vmware spring advanced message queuing protocol vulnerabilityAny application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-middle interc…EPSS 0.27%6.5CVE-2026-59271Vmware spring advanced message queuing protocol error message information leak vulnerabilityWhen the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AM…EPSS 0.32%6.5CVE-2026-47860Vmware spring advanced message queuing protocol vulnerabilityAn attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 …EPSS 0.42%6.5CVE-2021-22095Vmware spring advanced message queuing protocol deserialization of untrusted data vulnerabilityIn Spring AMQP versions 2.2.0 - 2.2.19 and 2.3.0 - 2.3.11, the Spring AMQP Message object, in its toString() method, will create a new String object …EPSS 1.1%6.5CVE-2021-22097Vmware spring advanced message queuing protocol deserialization of untrusted data vulnerabilityIn Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a me…EPSS 1.1%4.9CVE-2026-59275Vmware spring advanced message queuing protocol deserialization of untrusted data vulnerabilityA single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for ever…EPSS 0.45%4.3CVE-2023-34050Vmware spring advanced message queuing protocol deserialization of untrusted data vulnerabilityIn spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing…EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2026-59320), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.