CVE-2026-59275: CWE-502 Deserialization of Untrusted Data in Spring Spring AMQP

This vulnerability in Spring AMQP involves unsafe deserialization of untrusted data, which can be exploited by sending a hostile AMQP message that triggers a call to System.exit(99). This causes the entire JVM hosting the consumer to terminate, not just the affected listener thread, leading to full loss of availability for all workloads co-located in that JVM process. The affected versions explicitly include 4.1.0, 4.0.0 to 4.0.4, 3.2.0 to 3.2.12, and 2.4.18 and earlier. The CVSS v3.1 base score is 6.6, indicating a medium severity with network attack vector, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Exploitation of this vulnerability results in the termination of the entire consumer JVM process, causing a complete denial of service for all applications running within that JVM. This leads to full availability loss for every workload co-located in the affected process. There is also a high impact on confidentiality and integrity as indicated by the CVSS vector, though the primary concern is availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, users should consider isolating AMQP consumers in dedicated JVM processes to limit impact and apply strict input validation or message filtering if possible.