Vulnerability · Published Aug 27, 2026 · Assigned by vmware

CVE-2026-59320In Spring AMQP the link credit never replenished on listener exception path

Medium 6.5

In plain English

A medium-severity security flaw in Spring AMQP from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 63.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0

Affected products (as reported)

Vendor	Product	Versions
Spring	Spring AMQP	4.1.0

Weakness: CWE-772 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://spring.io/security/cve-2026-59320