Skip to content
OpenAdvisories
Medium · 6.6 CVE-2026-59275 EUVD-2026-66849GHSA-h7q9-2m8q-h4jr

Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

Published Aug 27, 2026 · Updated Aug 28, 2026 · Assigned by vmware

Description

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier

Affected products

VendorProductAffectedFixed
Spring Spring AMQP 4.1.0, 4.0.0 – ≤ 4.0.4, 3.2.0 – ≤ 3.2.12, ≤ 2.4.18 —

References