Skip to content
CVE PROGRAM SOURCE RECORD6.6 Medium

CVE-2026-59275

Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring AMQP

Default version status: unaffected

  • 4.1.0affected
  • 4.0.0 to ≤ 4.0.4affected
  • 3.2.0 to ≤ 3.2.12affected
  • 0 to ≤ 2.4.18affected

References