# CVE-2026-59320: Spring AMQP link credit exhaustion in error handler

Source: https://junglewise.ai/threats/cve-2026-59320-spring-amqp-link-credit-exhaustion-in-error-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-59320 · Severity: medium · CVSS 6.5 · Published 2026-08-27

Spring AMQP is a messaging library used by Java applications to communicate over AMQP brokers like RabbitMQ. When an error handler is configured, failed message deliveries permanently consume link credits; after exhaustion, the broker stops delivering messages, leaving the listener silently stalled even though the application reports it is still running. This causes message processing to hang indefinitely without clear indication of the problem.

Technologies: [Spring AMQP](https://junglewise.ai/threats/technologies/amqp). Vendors: [Spring](https://junglewise.ai/threats/vendors/spring), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-59320 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59320 being exploited in the wild.

**How severe is CVE-2026-59320?** Medium severity, with a CVSS score of 6.5, published 27 August 2026.

**Which products and versions are affected?** Spring AMQP 4.1.0.

**Is there a fix for CVE-2026-59320?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59320 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59320?** Check whether you run Spring AMQP or VMware Spring Advanced Message Queuing Protocol at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Spring AMQP 4.1.0 contains a resource exhaustion vulnerability in its container-level error handler. When a delivery fails and an error handler is configured (a mitigation for CVE-2026-50000), the framework does not properly restore link credits to the broker, causing each failed message to permanently consume one credit. After the default 100 initial credits are exhausted, the receiver's credit reaches zero and the broker halts delivery, leaving the listener in a stalled state while isRunning() incorrectly reports true. The attack vector is network-adjacent (requires broker connectivity) and no authentication bypass is involved; an attacker with access to send messages to the target broker can trigger failures via malformed or intentionally failing messages.

## Affected products

- Spring AMQP 4.1.0

## Timeline

- 2026-08-27: disclosed

## References

- [https://spring.io/security/cve-2026-59320](https://spring.io/security/cve-2026-59320)

## Related threats

- [Spring AMQP TLS certificate validation bypass](https://junglewise.ai/threats/cve-2026-59272-spring-amqp-tls-certificate-validation-bypass)
- [Spring AMQP denial of service via decompression bomb](https://junglewise.ai/threats/cve-2026-47860-spring-amqp-denial-of-service-via-decompression-bomb)