CVE-2026-47860
published 2026-08-27CVE-2026-47860: An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB…
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.24%
15.1th percentile
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_amqp | <= 2.4.18 | — |
| spring | spring_amqp | — | — |
| spring | spring_amqp | 3.2.0 – 3.2.12 | — |
| spring | spring_amqp | 4.0.0 – 4.0.4 | — |
| vmware | spring_advanced_message_queuing_protocol | < 2.4.19 | 2.4.19 |
| vmware | spring_advanced_message_queuing_protocol | >= 3.2.0 < 3.2.13 | 3.2.13 |
| vmware | spring_advanced_message_queuing_protocol | >= 4.0.0 < 4.0.4.1 | 4.0.4.1 |
| vmware | spring_advanced_message_queuing_protocol | >= 4.1.0 < 4.1.0.1 | 4.1.0.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
VMware Spring AMQP up to 2.4.18/3.2.12/4.0.4/4.1.0 Decompression data amplification
vuldb·2026-08-27·CVSS 6.5
CVE-2026-47860 [MEDIUM] VMware Spring AMQP up to 2.4.18/3.2.12/4.0.4/4.1.0 Decompression data amplification
A vulnerability has been found in VMware Spring AMQP up to 2.4.18/3.2.12/4.0.4/4.1.0 and classified as problematic. Impacted is an unknown function of the component Decompression. This manipulation causes highly compressed data.
The identification of this vulnerability is CVE-2026-47860. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.
ghsa_unreviewed·2026-08-27
CVE-2026-47860 [MEDIUM] An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message.
Spring AMQP 4.1.0
Spring AMQP 4.0.0 - 4.0.4
Spring AMQP 3.2.0 - 3.2.12
Spring AMQP 2.4.18 and earlier
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-27
Published