6.5

CVE-2026-47860

Unbounded decompression of attacker-supplied compressed message bodies

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Spring Advanced Message Queuing Protocol Version >= 3.2.0 < 3.2.13
VMware ≫ Spring Advanced Message Queuing Protocol Version >= 4.0.0 < 4.0.4.1
VMware ≫ Spring Advanced Message Queuing Protocol Version >= 4.1.0 < 4.1.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.142
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
VMware 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

https://spring.io/security/cve-2026-47860
Vendor Advisory