← Back

CVE-2026-47860

nvd nist
Published: Aug 27, 2026Modified: Sep 2, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: security@vmware.com (Secondary)

Description

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier

Affected (4)

Vmware
1 product
Spring Advanced Message Queuing Protocol
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Advanced Message Queuing Protocol
Before 2.4.19
Spring Advanced Message Queuing Protocol
From 3.2.0 to 3.2.13
Spring Advanced Message Queuing Protocol
From 4.0.0 to 4.0.4.1
Spring Advanced Message Queuing Protocol
From 4.1.0 to 4.1.0.1

Related CWEs

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.