CVE-2026-47860 Security Details

CVE ID

CVE-2026-47860

CWE

CWE-835

CVE Description

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Published

Aug 20, 2026

CVSS Score & Severity

7.1High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.420%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/amqp/support/postprocessor/AbstractDecompressingPostProcessor.postProcessMessage(Lorg/springframework/amqp/core/Message;)Lorg/springframework/amqp/core/Message;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT