What is CVE-2026-59320?

CVE-2026-59320 is a medium-severity vulnerability in Spring Amqp, classified under CWE-772 MISSING RELEASE OF RESOURCE AFTER EFFECTIVE LIFETIME. CVSS score: 6.5/10. Published 2026-08-27.

How severe is CVE-2026-59320?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Spring Amqp

CVE-2026-59320

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Spring Amqp — versions 4.1.0

References

security@vmware.com

Frequently asked questions

What is CVE-2026-59320?: CVE-2026-59320 is a medium-severity vulnerability in Spring Amqp, classified under CWE-772 MISSING RELEASE OF RESOURCE AFTER EFFECTIVE LIFETIME. CVSS score: 6.5/10. Published 2026-08-27.
How severe is CVE-2026-59320?: Medium severity. CVSS v3 base score is 6.5 out of 10.