CVE-2026-59275
published 2026-08-27CVE-2026-59275: A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload…
PriorityP423medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
EPSS
0.45%
38.5th percentile
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_amqp | <= 2.4.18 | — |
| spring | spring_amqp | — | — |
| spring | spring_amqp | 3.2.0 – 3.2.12 | — |
| spring | spring_amqp | 4.0.0 – 4.0.4 | — |
| vmware | spring_advanced_message_queuing_protocol | < 2.4.19 | 2.4.19 |
| vmware | spring_advanced_message_queuing_protocol | >= 3.2.0 < 3.2.13 | 3.2.13 |
| vmware | spring_advanced_message_queuing_protocol | >= 4.0.0 < 4.0.4.1 | 4.0.4.1 |
| vmware | spring_advanced_message_queuing_protocol | >= 4.1.0 < 4.1.0.1 | 4.1.0.1 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.springframework.amqp/spring-amqp: Spring AMQP: Remote JVM termination via hostile AMQP message
vendor_redhat·2026-08-27·CVSS 4.9
CVE-2026-59275 [MEDIUM] CWE-617 org.springframework.amqp/spring-amqp: Spring AMQP: Remote JVM termination via hostile AMQP message
org.springframework.amqp/spring-amqp: Spring AMQP: Remote JVM termination via hostile AMQP message
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
A flaw was found in Spring AMQP. A remote attacker could send a specially crafted, hostile Advanced Message Queuing Protocol (AMQP) message. This message could bypass allowlist protections and trigger a StackOverflowError, leading to the termination of the entire consumer Java Virtual Machine (JVM). This results in a complete loss of availability for all workloads co-located in that process.
Package: spri
GHSA
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process.
ghsa_unreviewed·2026-08-27
CVE-2026-59275 [MEDIUM] CWE-502 A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process.
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-27
Published