CVE-2026-59275

Analyzed Analyzed - Analysis Complete

Denial of Service in Spring AMQP

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59275

EUVD

EUVD-2026-66849

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_advanced_message_queuing_protocol	to 2.4.19 (exc)
vmware	spring_advanced_message_queuing_protocol	From 3.2.0 (inc) to 3.2.13 (exc)
vmware	spring_advanced_message_queuing_protocol	From 4.0.0 (inc) to 4.0.4.1 (exc)
vmware	spring_advanced_message_queuing_protocol	From 4.1.0 (inc) to 4.1.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability allows a single malicious AMQP message to exploit a Java deserialization bypass in Spring AMQP. It triggers a StackOverflowError, which activates the default JavaLangErrorHandler and forces the entire consumer JVM to terminate with System.exit(99). This results in complete loss of availability for all workloads running in that process.

Detection Guidance

Detecting this vulnerability requires checking the version of Spring AMQP in use. Commands like 'find / -name "spring-amqp*.jar" 2>/dev/null' or checking dependency files (e.g., pom.xml, build.gradle) for affected versions can help. Monitor JVM logs for StackOverflowError or System.exit(99) events.

Impact Analysis

The impact includes full system downtime for any application using affected Spring AMQP versions. Since the JVM crashes entirely, all services running in that process become unavailable, leading to disrupted operations and potential data loss.

Compliance Impact

This vulnerability could lead to violations of availability requirements in GDPR and HIPAA. Downtime from a crashed JVM may result in unauthorized data access or loss of critical health or personal data, triggering compliance breaches and potential penalties.

Mitigation Strategies

Upgrade to fixed versions: 4.1.1 (OSS), 4.0.5 (OSS), 3.2.13 (Enterprise), or 2.4.19 (Enterprise). Enterprise users should apply 4.1.0.1, 4.0.4.1, or 3.2.13. No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59275. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70