Description

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T20:17:58.030Z",
  "pubdate": "2026-08-27T20:17:58.030Z",
  "executiveSummary": "A denial-of-service vulnerability exists in Spring AMQP 4.1.0 where a misconfiguration or malicious payload sequence can lead to a complete cessation of message consumption.\nThe vulnerability occurs when a container-level ErrorHandler is utilized, causing the AMQP link credit management system to improperly track message processing failures.\nSpecifically, each message delivery that triggers an error permanently consumes a link credit, regardless of whether the message is successfully acknowledged or rejected.\nThis behavior results in a progressive depletion of available credits until the receiver reaches zero, at which point the broker halts all message deliveries.\nBecause the listener container maintains an isRunning() status of true, the application enters a silent stall state, effectively causing a permanent denial of service for the impacted consumer.\nExploitation does not require elevated privileges, as an attacker capable of sending messages that trigger processing exceptions can systematically drain the credit limit.\nThe risk is high in environments where message delivery is critical, as automated monitoring may fail to detect the stall due to the container reporting a healthy state.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of AMQP credit-based flow control within the Spring AMQP listener container when an ErrorHandler is actively processing container-level exceptions.\nIn AMQP 1.0 protocols, credit flow control manages the number of messages a sender can push to a receiver. Each message delivery consumes one link credit. Under normal operation, when a message is acknowledged or rejected, the credit should be replenished to ensure a continuous stream of traffic.\nIn Spring AMQP 4.1.0, when a message throws an exception that is handled by a container-level ErrorHandler, the credit management logic fails to replenish the credit associated with that delivery. This design flaw essentially treats an error-prone message as if it occupied a credit slot indefinitely.\nThe attack flow follows a deterministic pattern: First, an attacker identifies the 'initialCredits' configuration parameter (defaulting to 100). Second, the attacker submits a sequence of malformed or trigger-heavy messages that are guaranteed to throw exceptions during the listener's processing phase.\nEach exception processed by the ErrorHandler results in the irreversible decrement of the credit pool. Once the counter reaches zero, the underlying AMQP connection ceases to request or receive further messages from the broker.\nThe technical impact is compounded by the fact that the listener container does not transition to a stopped state. The isRunning() method continues to return true, masking the stalled condition from orchestration platforms or health check mechanisms that rely on standard state reporting.\nThis vulnerability is particularly insidious because it requires no authentication or special network access beyond the ability to enqueue messages to the target consumer. A remote attacker can trigger this state repeatedly, effectively silencing specific consumers at will.\nThe vulnerable component is the message listener container credit manager, which fails to account for state synchronization between the ErrorHandler and the link-flow controller, leading to a permanent exhaustion of the protocol-level message budget."
}