When a container-level ErrorHandler is enabled in Spring AMQP, each message that throws an exception consumes one broker link credit that is never replenished. After the configured initialCredits (default 100) have been exhausted, the receiver’s credit reaches zero and the broker stops delivering new messages. The listener thread continues to report that it is running, causing a silent stall of the consumer. Based on the description, this flaw leads to a denial of service that stalls the consumer thread. The improper resource handling aligns with the CWE-772 classification.

The issue impacts any deployment of the Spring AMQP library that uses a container-level ErrorHandler. Based on the description, the flaw is known in Spring AMQP 4.1.0 and thus applies to that version and earlier releases that rely on the default initialCredits setting of 100. The vulnerability affects application code that integrates Spring AMQP and does not alter broker behaviour; the broker itself remains functional until credit exhaustion occurs.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is 0.00289 (<1%), indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, implying limited evidence of active exploitation. Exploitation requires misbehavior within the application: a configured ErrorHandler and repeated message processing failures. An attacker who can influence the application to generate such failures could precipitate the DoS. Because exploitation does not rely on special network traffic, the risk is primarily operational rather than remote, though any environment that accepts untrusted input could be targeted by an attacker who can exacerbate failures.