CVE-2026-59320

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59320
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59320.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-59320
Published
2026-08-27T18:04:47Z
Modified
2026-09-02T03:47:26Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
In Spring AMQP the link credit never replenished on listener exception path
Details

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0

Database specific 
{
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59320.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.1.0"
                },
                {
                    "last_affected": "4.1.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/spring-projects/spring-amqp

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-amqp
Events
Introduced
414086a99c8a7a326425e84976ff5d8651c6d0ae
Fixed
cc1c35f30c3e2f06af1c9f258d71b0255e9e5ddc
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:vmware:spring_advanced_message_queuing_protocol:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.1.0"
        },
        {
            "fixed": "4.1.1"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v4.*
v4.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59320.json"