CVE-2026-59320 json
In Spring AMQP the link credit never replenished on listener exception path
published 2026-08-27 2 mo ago modified 2026-08-31 2 mo ago also EUVD-2026-67201
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0
Patch / fix
- vmware spring_advanced_message_queuing_protocol 4.1.1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-59320 updated cvss 6.5
org.springframework.amqp/spring-amqp: Spring AMQP: Denial of Service due to link credit exhaustion
-
Red Hat build of Apache Camel 4 for Quarkus 3 spring-amqp 3.2.9affected: no fix available “Fix deferred”
-
Red Hat Fuse 7 spring-amqp 3.2.9affected: no fix planned “Out of support scope”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Affected products
- Spring Spring AMQP
Classification
- Weakness
-
- CWE-772 Missing Release of Resource after Effective Lifetime
References
-
spring.io
/security/cve-2026-59320
vendor-advisory
Sources
- CVE List CVE-2026-59320
- NVD CVE-2026-59320
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.