CVE-2026-59275: Remote JVM termination: nested-array Java deserialization bypasses allowlist, triggers StackOverflowError, default JavaLangErrorHandler calls System.exit(99)

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-27 · updated 2026-09-01
Weakness: CWE-502

Description

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Affected products

Spring AMQP: before 2.4.19; from 3.2.0 before 3.2.13; from 4.0.0 before 4.0.4.1; from 4.1.0 before 4.1.0.1 — fixed in 2.4.19, 3.2.13, 4.0.4.1, 4.1.0.1
Spring AMQP: from 4.0.0 through 4.0.4; from 3.2.0 through 3.2.12; through 2.4.18; 4.1.0

How to fix

Upgrade to a fixed version: Spring AMQP 2.4.19, 3.2.13, 4.0.4.1, 4.1.0.1. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-59275

Get alerted when CVE-2026-59275 or the next vulnerability affects your stack