Message Decompression Vulnerability in Spring AMQP by Pivotal Software
CVE-2026-47860

6.5MEDIUM

Key Information:

Vendor

Spring

Status
Spring AMQp
Vendor
CVE Published:
26 August 2026

What is CVE-2026-47860?

An identified flaw in Spring AMQP could allow an attacker to exploit message decompression functionality, leading to potential crashes of the consumer's Java Virtual Machine (JVM) with a maliciously crafted message of approximately 1 MB in size. This vulnerability affects multiple versions of Spring AMQP, making it imperative for users to review their systems and apply the necessary updates or mitigations.

Affected Version(s)

Spring AMQP 4.1.0

Spring AMQP 4.0.0 <= 4.0.4

Spring AMQP 3.2.0 <= 3.2.12

References

https://spring.io/security/cve-2026-47860

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.