CVE-2026-59275 in Spring AMQP
Summary
by MITRE • 08/27/2026
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in the Apache ActiveMQ Artemis client, specifically affecting versions of Spring AMQP prior to 4.1.0, represents a critical availability risk stemming from improper handling of incoming Advanced Message Queuing Protocol messages. The core technical flaw lies in the message deserialization and processing logic within the consumer endpoint. When a maliciously crafted AMQP message is received by an application utilizing these vulnerable versions of Spring AMQP, it triggers an execution path that results in the invocation of System.exit(99). This behavior is not confined to terminating the specific thread responsible for listening or consuming messages; instead, it forcibly shuts down the entire Java Virtual Machine process hosting the consumer. Such a design choice effectively bypasses standard exception handling mechanisms and error recovery protocols, leading to an immediate and total cessation of all operations within that JVM instance.
From an operational perspective, this vulnerability results in complete service unavailability for any workload co-located within the same application server or microservice container. In modern distributed architectures where multiple services often share a single process space for resource efficiency, the termination of one consumer can cascade into broader system failures. The impact extends beyond simple message loss; it constitutes a denial-of-service condition that affects all dependent components running in the affected JVM. Attackers capable of injecting or redirecting AMQP traffic toward vulnerable endpoints can exploit this flaw to cause persistent outages without needing elevated privileges on the host machine, relying solely on network-level access to deliver the malicious payload.
This vulnerability aligns with CWE-754: Improper Check for Unusual or Exceptional Conditions and CWE-286: Incorrect User Group Assignment if interpreted through the lens of privilege escalation leading to process termination. In terms of offensive security frameworks, it maps directly to MITRE ATT&CK technique T1499: Endpoint Denial of Service, specifically under sub-techniques involving application exhaustion or resource manipulation. The use of System.exit() is a severe anti-pattern in enterprise applications as it prevents graceful shutdown procedures and leaves resources such as database connections, file handles, and network sockets in an undefined state, potentially causing secondary issues during subsequent restarts or health checks.
Mitigation strategies must prioritize immediate patching to the latest stable release of Spring AMQP where this behavior has been corrected. For environments unable to upgrade immediately, defensive coding practices should be implemented by wrapping message listener invocations in robust try-catch blocks that explicitly prevent propagation of fatal exceptions leading to process termination. Additionally, network segmentation and strict input validation at the broker level can reduce exposure. Security teams should monitor for unusual JVM shutdown events correlated with high AMQP traffic volumes as an indicator of compromise. It is also advisable to review application configurations to ensure that critical services are not overly dependent on single-process deployments where a single point of failure could impact multiple business functions.