CVE-2026-59275: Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to full JVM termination?
Spring AMQP consumers running version 4.1.0, 4.0.0 through 4.0.4, 3.2.0 through 3.2.12, or 2.4.18 and earlier are listed as affected. The impact extends to every workload co-located in the consumer JVM, not only the AMQP listener thread.
What does an attacker need to do to trigger the denial of service?
An attacker needs to send a single hostile AMQP message that uses nested-array Java deserialization to bypass the allowlist and trigger a StackOverflowError. Exploitation is network-reachable, but the supplied vector also indicates high attack complexity and high privileges required.
Are applications using the default error handling behavior affected?
Yes. The described termination occurs because the default JavaLangErrorHandler handles the StackOverflowError by calling System.exit(99), terminating the consumer JVM.
How can I determine whether an outage was caused by this issue?
Look for a consumer JVM exiting with status 99 after processing an AMQP message, with a StackOverflowError associated with nested-array Java deserialization. The provided data does not identify additional indicators or logging signatures.