CVE-2026-47860

MediumCVSS 6.5/10Last modified Sep 2, 2026

Description

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

VendorProductVersions
SpringSpring AMQP4.1.0; >= 4.0.0, <= 4.0.4; >= 3.2.0, <= 3.2.12; <= 2.4.18

References

Timeline

Published
Aug 27, 2026
Last modified
Sep 2, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-478616.3An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emitCVE-2026-478625.4An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resuCVE-2026-478637.5In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (CVE-2026-478649.8SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering.CVE-2026-478659.8VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the AviCVE-2026-478668.3VMware Avi Load Balancer contains an authorization bypass vulnerability. A malicious actor on the network can access a limited subset of theCVE-2026-478678.8VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious user with network access may be able to access the Avi CVE-2026-478687.8VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate theCVE-2026-478698.8VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to iCVE-2026-478708.8VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to exCVE-2026-478718.8VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network CVE-2026-478738.0The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) ra