CyberRota Analysis
AI-GeneratedApplications using Spring AMQP versions 2.4.18 and earlier, up to 4.1.0, are vulnerable to a denial-of-service attack where an attacker can crash the consumer JVM by sending a single message of approximately 1 MB that triggers message decompression. This vulnerability poses a medium severity risk, and organizations utilizing these specific Spring AMQP versions should prioritize patching to mitigate potential service disruptions.
CVE
CVE-2026-47860
Severity
MEDIUM
CVSS
6.5
EPSS
0.24%
Original NVD Description
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Related CVEs
Other vulnerabilities affecting the same vendor(s)