CVE-2026-59320

The record

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true. Spring AMQP 4.1.0

Affected packages

Related vulnerabilities

• CVE-2026-59951 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-772
• CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending forever. CWE-772
• CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets… CWE-772
• CVE-2026-73508 Netty is an asynchronous, event-driven network application framework. CWE-772
• CVE-2026-73215 Coturn is a free open source implementation of TURN and STUN Server. CWE-772
• CVE-2026-11811 The UpdateHub over-the-air update client's start_coap_client() in… CWE-772
• CVE-2026-13505 In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2… CWE-772
• CVE-2026-49343 Klever-Go is the Go implementation of the Klever blockchain protocol. CWE-772