CVE-2026-59320

Analyzed Analyzed - Analysis Complete

ErrorHandler Link Credit Exhaustion in Spring AMQP

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: VMware

Description

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59320

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_advanced_message_queuing_protocol	From 4.1.0 (inc) to 4.1.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in Spring AMQP when a container-level ErrorHandler is set up to handle message processing errors. Each failed message delivery permanently uses one link credit. After 100 failed messages (default credits), the receiver stops receiving new messages, causing the listener to stall silently while still reporting as active.

Detection Guidance

Check if Spring AMQP listeners are stuck in a running state despite no message processing. Monitor link credit exhaustion by verifying if the receiver's credit balance reaches zero after repeated message failures. Inspect logs for exceptions during message processing that coincide with stalled listeners.

Impact Analysis

The vulnerability can cause message processing to halt unexpectedly. The system appears functional (isRunning() returns true) but stops processing messages after 100 failures, leading to lost or delayed messages and potential service disruptions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it relates to message processing failures in Spring AMQP rather than data protection or privacy controls.

Mitigation Strategies

Upgrade to Spring AMQP version 4.1.0.1 (Enterprise Support) or 4.1.1 (OSS) to resolve the issue. No additional mitigation steps are required after upgrading.

Hi! I’m here to help you understand CVE-2026-59320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70