CVE-2026-59320: CWE-772 Missing Release of Resource after Effective Lifetime in Spring Spring AMQP

This vulnerability (CWE-772) in Spring AMQP 4.1.0 involves missing release of resources after their effective lifetime. Specifically, when a container-level ErrorHandler is configured, each failed message delivery consumes one link credit permanently. Once the default initialCredits (100) are consumed by failing messages, the receiver's credit reaches zero, causing the broker to halt message delivery. The listener remains in an isRunning() state but is effectively stalled, leading to denial of service conditions in message processing.

The impact is a denial of service where message processing is silently stalled after a threshold of failing messages is reached. This causes the message listener to stop receiving new messages without explicit failure signals, potentially disrupting applications relying on Spring AMQP for messaging. There is no direct confidentiality or integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is indicated in the provided data. Users should monitor vendor communications for patches or official mitigations. Until then, consider limiting the use of container-level ErrorHandler or implementing external monitoring to detect stalled listeners.