---
id: CVE-2026-59320
title: >-
  When a container-level ErrorHandler is configured (the mitigation for finding
  221000), each delivery whose processing throws still permanently consumes one
  link credit
summary: >-
  When a container-level ErrorHandler is configured (the mitigation for finding
  221000), each delivery whose processing throws still permanently consumes one
  link credit. After initialCredits (default 100) failing messages the
  receiver's c…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-772
published: '2026-08-27'
updated: '2026-08-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59320'
references:
  - url: 'https://spring.io/security/cve-2026-59320'
    label: security@vmware.com
tags:
  - nvd
epss: 0.00296
epssPercentile: 0.22475
ingestedAt: '2026-08-29T21:42:36.055Z'
---

## Overview

When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing throws still permanently consumes one link credit. After initialCredits (default 100) failing messages the receiver's credit reaches zero and the broker stops delivering, leaving the listener silently stalled while isRunning() remains true.
Spring AMQP 4.1.0

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.