CVE-2026-47860 — Unbounded decompression of attacker-supplied compressed message bodies

CVE-2026-47860

Unbounded decompression of attacker-supplied compressed message bodies PUBLISHED

Description (CNA)

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Spring AMQP	affected 4.1.0; affected 4.0.0 through 4.0.4; affected 3.2.0 through 3.2.12; affected 0 through 2.4.18

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47860

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.