CVE-2026-59320: In Spring AMQP the link credit never replenished on listener exception path
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring AMQPto a version that resolves this vulnerability.Fixed in 4.1.0 - Configuration
Since configuring a container-level ErrorHandler (mitigation for finding 221000) causes each delivery whose processing throws to permanently consume one link credit (link credit never replenished on the listener exception path), adjust the ErrorHandler configuration so thrown-processing deliveries do not permanently exhaust link credit (e.g., remove/avoid the container-level ErrorHandler mitigation if not required, or change exception handling so the listener exception path does not trigger this behavior).
Spring AMQP container-level ErrorHandler (mitigation for finding 221000) = avoid/disable if possible for listener exception path
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments use Spring AMQP 4.1.0 with a container-level ErrorHandler configured and have listener deliveries whose processing throws exceptions. The issue occurs on the exception path, where each failed delivery consumes link credit permanently.
How quickly can a listener stall under the default credit setting?
The default initialCredits value is 100. A listener can stall after 100 failing messages, when its available receiver credit reaches zero and the broker stops delivering messages.
How can operators recognize that this condition has occurred?
The listener will stop receiving deliveries because the broker has no remaining credit to send messages. The container can still report isRunning() as true, so a running-state check alone will not identify the stall.
What exploitation conditions are indicated by the provided severity data?
The supplied vector indicates network access, low attack complexity, low privileges required, and no user interaction. The recorded impact is availability only, with no confidentiality or integrity impact listed.