CVE-2026-59275 Overview
CVE-2026-59275 affects Spring AMQP, the messaging abstraction layer used to integrate Java applications with AMQP brokers such as RabbitMQ. A specially crafted hostile AMQP message can trigger System.exit(99) inside the consumer Java Virtual Machine (JVM). The termination affects the entire process, not just the listener thread handling the message. Every workload co-located within that JVM loses availability when the condition triggers.
Critical Impact
A single malicious AMQP message can terminate the consumer JVM through System.exit(99), causing full availability loss for all co-located workloads in the process.
Affected Products
- Spring AMQP 4.1.0
- Spring AMQP 4.0.0 through 4.0.4 and 3.2.0 through 3.2.12
- Spring AMQP 2.4.18 and earlier
Discovery Timeline
- 2026-08-27 - CVE-2026-59275 published to the National Vulnerability Database (NVD)
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-59275
Vulnerability Analysis
Spring AMQP provides listener containers that dispatch broker messages to application handlers. When a message triggers an unrecoverable error condition during processing, the container invokes a termination path that calls System.exit(99). This behavior escalates a single-message failure into a full JVM shutdown.
Any application sharing that JVM, including unrelated services, scheduled jobs, and connection pools, terminates simultaneously. The impact extends beyond a rejected or dead-lettered message and produces a denial-of-service condition across the entire process.
Root Cause
The listener container treats certain fatal exceptions by exiting the JVM instead of stopping only the affected consumer. An attacker with the ability to publish messages to a queue consumed by a vulnerable Spring AMQP client can craft input that reaches this termination path. The design conflates listener-level fatal errors with process-level fatal errors.
Attack Vector
Exploitation requires network reachability to the AMQP broker and privileges to publish to a queue that a vulnerable consumer reads. The attack complexity is high because the attacker must construct a message that triggers the specific fatal-exception branch inside the listener container. No user interaction is required. Successful exploitation halts the consumer process.
Refer to the Spring Security Advisory CVE-2026-59275 for message construction and code-path details.
Detection Methods for CVE-2026-59275
Indicators of Compromise
- Unexpected JVM exits with status code 99 recorded in process supervisors, container orchestrators, or systemd journals.
- Spring AMQP listener log entries referencing fatal exceptions immediately before process termination.
- Correlated broker-side delivery of a message from an untrusted or unusual publisher just prior to consumer shutdown.
Detection Strategies
- Alert on Spring Boot or Spring AMQP application processes terminating with exit code 99 outside of planned restarts.
- Correlate AMQP publisher identity, routing key, and message payload metadata with consumer restart events in the observability pipeline.
- Baseline consumer uptime and flag sudden clusters of pod or container restarts consuming from the same queue.
Monitoring Recommendations
- Ingest JVM exit codes, container restart events, and Spring AMQP listener logs into a centralized SIEM or data lake for correlation.
- Monitor RabbitMQ audit logs for new or unusual publishers on queues consumed by production services.
- Track dead-letter queue depth and consumer restart frequency as leading indicators of exploitation attempts.
How to Mitigate CVE-2026-59275
Immediate Actions Required
- Inventory all Java services using Spring AMQP and identify versions 4.1.0, 4.0.0–4.0.4, 3.2.0–3.2.12, and 2.4.18 or earlier.
- Restrict AMQP publish permissions so only trusted producers can write to queues consumed by production services.
- Enable process-level restart supervision so consumer JVMs recover automatically until patches are applied.
Patch Information
Upgrade Spring AMQP to a fixed release as listed in the Spring Security Advisory CVE-2026-59275. Consumers running Spring AMQP 4.1.0, 4.0.0–4.0.4, 3.2.0–3.2.12, or 2.4.18 and earlier should update to the corresponding patched version identified by the vendor.
Workarounds
- Apply strict broker-side authorization so that only vetted service accounts can publish to consumer queues.
- Deploy consumer applications in isolated JVMs so that a termination event does not take down unrelated workloads.
- Enforce message schema validation at the broker or gateway layer to reject malformed AMQP payloads before they reach vulnerable consumers.
# Configuration example
# Restrict RabbitMQ publish permissions to a specific service account on a queue
rabbitmqctl set_permissions -p /prod trusted-publisher "^orders\\." "^orders\\." "^$"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
