A malicious AMQP message crafted with a nested array structure bypasses Spring AMQP's deserialization allowlist. The deserialization process overflows the stack, causing a StackOverflowError. The default JavaLangErrorHandler then invokes System.exit(99), terminating the entire JVM. This results in a complete loss of availability for the consumer and all other workloads running in the same process. The vulnerability is an instance of insecure deserialization, classified as CWE‑502.

The affected software is Spring AMQP from the Spring framework. Vulnerable versions include Spring AMQP 4.1.0, 4.0.0 through 4.0.4, 3.2.0 through 3.2.12, and any release version 2.4.18 and earlier. All installations of these versions exposed to untrusted AMQP traffic are at risk.

The CVSS score of 6.6 rates this issue as moderate, but the exploitability can be high because it requires only a single crafted AMQP packet from an external party. EPSS is not available, and the vulnerability is not currently listed in the CISA KEV catalog. A likely attack vector is a remote AMQP client that can send messages to the consumer queue. Successful exploitation results in immediate process termination and a denial of service for the entire JVM, making timely remediation critical.