An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1… (CVE-2026-47860)

This vulnerability allows an attacker with permission to publish messages to a queue to cause a denial of service by crashing the Java Virtual Machine (JVM) of the consumer application if message decompression is enabled. The attack requires sending a single message of about 1 MB in size. The affected versions include Spring AMQP 4.1.0, 4.0.0 to 4.0.4, 3.2.0 to 3.2.12, and 2.4.18 and earlier. The CVSS 3.1 score is 6.5 (medium severity) with an attack vector of network, low attack complexity, requiring low privileges, no user interaction, and impact limited to availability (denial of service). No known exploits are reported in the wild. No patch or remediation information is provided in the source data.

The vulnerability causes a denial of service by crashing the consumer JVM, disrupting the availability of the application consuming messages from the queue. There is no impact on confidentiality or integrity. Exploitation requires the ability to publish messages to the queue and that the consumer application has message decompression enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or monitor access to message queues to prevent unauthorized publishing. Consider disabling message decompression if feasible as a temporary mitigation.