CVE-2026-59320CWE-772

CVE-2026-59320

Medium · published August 28, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
35.2
In the wild
Unconfirmed
What it is

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.

Spring AMQP 4.1.0

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.2th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2026-08-28T00:17Z
Affected products (1)
ProductVersionsFixed in
vmware/spring_advanced_message_queuing_protocol≥ 4.1.0, < 4.1.14.1.1
References (1)
https://spring.io/security/cve-2026-59320 · [email protected]
EPSS history
Timeline
  • 27 AUG 18:04Z
    In Spring AMQP the link credit never replenished on listener exception path
    cvelistv5