Description

A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss for every workload co-located in that process. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-27T06:17:22.073Z",
  "pubdate": "2026-08-27T06:17:22.073Z",
  "executiveSummary": "A critical vulnerability in Spring AMQP allows an unauthenticated attacker to trigger an immediate, process-wide termination of the JVM by sending a specially crafted AMQP message.\nThe vulnerability manifests as an improper handling of input within the listener container, leading to an invocation of System.exit(99).\nThis impacts the availability of the entire JVM, resulting in a total denial-of-service (DoS) for all workloads co-located within the affected process, not merely the specific listener thread.\nThe vulnerability affects Spring AMQP versions 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.\nThe risk is severe, as the exploitation requires no prior authentication and can be executed by any actor capable of pushing a malicious payload to an AMQP broker monitored by a vulnerable consumer.\nSuccessful exploitation results in immediate service disruption, requiring manual intervention or orchestration restart to recover the affected services.",
  "technicalDetails": "The vulnerability originates from a failure in input validation or exception handling within the AMQP listener infrastructure of Spring AMQP. When the consumer processes a malformed or hostile AMQP message, the logic within the affected component enters an error state that triggers a call to System.exit(99).\nUnlike localized exception handling that might terminate a specific processing thread, this vulnerability results in an exit call that impacts the entire JVM process. In a microservices architecture, this is particularly critical if multiple unrelated business services or listeners are co-located within the same JVM, as they will all be terminated simultaneously.\nThe attack flow involves the following steps: (1) The attacker crafts a malicious AMQP message designed to trigger the vulnerable code path during deserialization or message processing. (2) The attacker publishes this message to a queue that the vulnerable Spring AMQP consumer is monitoring. (3) The consumer receives the message and passes it to the listener container. (4) During the execution of the processing logic, the application encounters the flaw which culminates in the execution of the System.exit(99) command.\nThis flaw is essentially a remote command execution of a system-level termination request that does not require user interaction or pre-existing authentication, provided the attacker can reach the message broker.\nAffected versions include: Spring AMQP 4.1.0, 4.0.0 through 4.0.4, 3.2.0 through 3.2.12, and 2.4.18 and earlier. The scope of this vulnerability covers standard AMQP consumer implementations using these affected libraries.\nBecause the call occurs within the application process space, there is no opportunity for the application to catch the termination signal at the application level, resulting in an ungraceful shutdown. This causes an immediate loss of availability for all active connections and pending tasks within the JVM."
}