CVE-2026-47860: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification, Decompression Bomb) in Spring Spring AMQP

CVE-2026-47860 is a vulnerability classified under CWE-409 (Improper Handling of Highly Compressed Data) in the Spring AMQP library. The flaw allows an attacker with the ability to publish messages to a queue to cause a denial of service by crashing the consumer JVM through a decompression bomb attack. The issue arises when message decompression is enabled, and a crafted highly compressed message of about 1 MB triggers excessive resource consumption leading to a crash. Affected versions explicitly include Spring AMQP 4.1.0, 4.0.0 through 4.0.4, 3.2.0 through 3.2.12, and 2.4.18 and earlier. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impact limited to availability (denial of service). No vendor advisory or patch information is currently available.

The vulnerability can cause a denial of service by crashing the Java Virtual Machine (JVM) of the consumer application processing messages from a queue when message decompression is enabled. This disrupts availability but does not impact confidentiality or integrity. Exploitation requires the ability to publish messages to the targeted queue, which may require some level of privilege or access within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling message decompression if feasible or restricting queue publishing permissions to trusted sources only to reduce the risk of exploitation.