CVE-2026-47860: Unbounded decompression of attacker-supplied compressed message bodies

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-26 · updated 2026-09-02
Weakness: CWE-835

Description

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Affected products

Spring AMQP: before 2.4.19; from 3.2.0 before 3.2.13; from 4.0.0 before 4.0.4.1; from 4.1.0 before 4.1.0.1 — fixed in 2.4.19, 3.2.13, 4.0.4.1, 4.1.0.1
Spring AMQP: from 4.0.0 through 4.0.4; from 3.2.0 through 3.2.12; through 2.4.18; 4.1.0

How to fix

Upgrade to a fixed version: Spring AMQP 2.4.19, 3.2.13, 4.0.4.1, 4.1.0.1. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-47860

Get alerted when CVE-2026-47860 or the next vulnerability affects your stack