CVE-2026-47860
Unbounded decompression of attacker-supplied compressed message bodies
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unbounded decompression of attacker-supplied compressed message bodies
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Record
CVE-2026-47860- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2026-66826
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Record
EUVD-2026-66826- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2jgf-w345-55x3
An attacker who can publish to a queue consumed by an application that has enabled message...
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Record
GHSA-2jgf-w345-55x3- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
NVD
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Record
CVE-2026-47860- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
Unbounded decompression of attacker-supplied compressed message bodies
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
- Record
CVE-2026-47860- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1792063484 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.2.12-tuxcare.2.
- Record
CLSA-2026-1792063484- Updated
- 2026-11-02
Show 19 moreShow less
OSVCLSA-2026-1792070331 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.2.11-tuxcare.2.
- Record
CLSA-2026-1792070331- Updated
- 2026-11-02
OSVCLSA-2026-1792075826 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.16-tuxcare.2.
- Record
CLSA-2026-1792075826- Updated
- 2026-11-02
OSVCLSA-2026-1792075935 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.2.8-tuxcare.1.
- Record
CLSA-2026-1792075935- Updated
- 2026-11-02
OSVCLSA-2026-1792076060 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.0.10-tuxcare.3.
- Record
CLSA-2026-1792076060- Updated
- 2026-11-02
OSVCLSA-2026-1792076165 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.17-tuxcare.9.
- Record
CLSA-2026-1792076165- Updated
- 2026-11-02
OSVCLSA-2026-1792077747 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 4 CVEs. Fixed in 2.3.10-tuxcare.1.
- Record
CLSA-2026-1792077747- Updated
- 2026-11-02
OSVCLSA-2026-1792077762 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 4 CVEs. Fixed in 2.3.6-tuxcare.1.
- Record
CLSA-2026-1792077762- Updated
- 2026-11-02
OSVCLSA-2026-1792077802 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.4-tuxcare.1.
- Record
CLSA-2026-1792077802- Updated
- 2026-11-02
OSVCLSA-2026-1792078059 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.4.12-tuxcare.2.
- Record
CLSA-2026-1792078059- Updated
- 2026-11-02
OSVCLSA-2026-1792078119 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.1.12-tuxcare.7.
- Record
CLSA-2026-1792078119- Updated
- 2026-11-02
OSVCLSA-2026-1792078146 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.3.16-tuxcare.2.
- Record
CLSA-2026-1792078146- Updated
- 2026-11-02
OSVCLSA-2026-1792078191 No score
TuxCare security update for org.springframework.amqp (6 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 6 CVEs. Fixed in 3.1.11-tuxcare.1.
- Record
CLSA-2026-1792078191- Updated
- 2026-11-02
OSVCLSA-2026-1792082894 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.3.7-tuxcare.3.
- Record
CLSA-2026-1792082894- Updated
- 2026-11-02
OSVCLSA-2026-1792083004 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 3 org.springframework.amqp packages to address 4 CVEs. Fixed in 3.1.8-tuxcare.5.
- Record
CLSA-2026-1792083004- Updated
- 2026-11-02
OSVCLSA-2026-1792084967 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.1.4.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792084967- Updated
- 2026-11-02
OSVCLSA-2026-1792086053 No score
TuxCare security update for org.springframework.amqp (3 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 3 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.2.
- Record
CLSA-2026-1792086053- Updated
- 2026-11-02
OSVCLSA-2026-1792088148 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 4 CVEs. Fixed in 2.2.12.RELEASE-tuxcare.1.
- Record
CLSA-2026-1792088148- Updated
- 2026-11-02
OSVCLSA-2026-1793186202 No score
TuxCare security update for org.springframework.amqp:spring-amqp (3 CVEs)
TuxCare rebuilt org.springframework.amqp:spring-amqp to address 3 CVEs. Fixed in 1.7.14.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793186202- Updated
- 2026-11-02
OSVCLSA-2026-1793186461 No score
TuxCare security update for org.springframework.amqp (4 CVEs)
TuxCare rebuilt 2 org.springframework.amqp packages to address 4 CVEs. Fixed in 2.1.17.RELEASE-tuxcare.1.
- Record
CLSA-2026-1793186461- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.2.12 up to 3.2.12-tuxcare.2, plus listed versions 3.2.12-tuxcare.1 |
3.2.12-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.12 up to 3.2.12-tuxcare.2, plus listed versions 3.2.12-tuxcare.1 |
3.2.12-tuxcare.2 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.12 up to 3.2.12-tuxcare.2, plus listed versions 3.2.12-tuxcare.1 |
3.2.12-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.2.11 up to 3.2.11-tuxcare.2, plus listed versions 3.2.11-tuxcare.1 |
3.2.11-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.11 up to 3.2.11-tuxcare.2, plus listed versions 3.2.11-tuxcare.1 |
3.2.11-tuxcare.2 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.11 up to 3.2.11-tuxcare.2, plus listed versions 3.2.11-tuxcare.1 |
3.2.11-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.4.16 up to 2.4.16-tuxcare.2, plus listed versions 2.4.16-tuxcare.1 |
2.4.16-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.4.16 up to 2.4.16-tuxcare.2, plus listed versions 2.4.16-tuxcare.1 |
2.4.16-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.2.8 up to 3.2.8-tuxcare.1 | 3.2.8-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.8 up to 3.2.8-tuxcare.1 | 3.2.8-tuxcare.1 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.2.8 up to 3.2.8-tuxcare.1 | 3.2.8-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.0.10 up to 3.0.10-tuxcare.3, plus listed versions 3.0.10-tuxcare.13.0.10-tuxcare.2 |
3.0.10-tuxcare.3 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.0.10 up to 3.0.10-tuxcare.3, plus listed versions 3.0.10-tuxcare.13.0.10-tuxcare.2 |
3.0.10-tuxcare.3 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.0.10 up to 3.0.10-tuxcare.3, plus listed versions 3.0.10-tuxcare.13.0.10-tuxcare.2 |
3.0.10-tuxcare.3 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.4.17 up to 2.4.17-tuxcare.9, plus listed versions 2.4.17-tuxcare.22.4.17-tuxcare.32.4.17-tuxcare.42.4.17-tuxcare.52.4.17-tuxcare.6 Show 4 moreShow less2.4.17-tuxcare.72.4.17-tuxcare.82.4.17.tuxcare2.4.17.tuxcare.1 |
2.4.17-tuxcare.9 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.4.17 up to 2.4.17-tuxcare.9, plus listed versions 2.4.17-tuxcare.22.4.17-tuxcare.32.4.17-tuxcare.42.4.17-tuxcare.52.4.17-tuxcare.6 Show 4 moreShow less2.4.17-tuxcare.72.4.17-tuxcare.82.4.17.tuxcare2.4.17.tuxcare.1 |
2.4.17-tuxcare.9 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
2.3.10 up to 2.3.10-tuxcare.1 | 2.3.10-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
2.3.10 up to 2.3.10-tuxcare.1 | 2.3.10-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
2.3.6 up to 2.3.6-tuxcare.1 | 2.3.6-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
2.3.6 up to 2.3.6-tuxcare.1 | 2.3.6-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.4.4 up to 2.4.4-tuxcare.1 | 2.4.4-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.4.4 up to 2.4.4-tuxcare.1 | 2.4.4-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.4.12 up to 2.4.12-tuxcare.2, plus listed versions 2.4.12-tuxcare.1 |
2.4.12-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.4.12 up to 2.4.12-tuxcare.2, plus listed versions 2.4.12-tuxcare.1 |
2.4.12-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.1.12 up to 3.1.12-tuxcare.7, plus listed versions 3.1.12-tuxcare.13.1.12-tuxcare.23.1.12-tuxcare.33.1.12-tuxcare.43.1.12-tuxcare.53.1.12-tuxcare.6 |
3.1.12-tuxcare.7 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.1.12 up to 3.1.12-tuxcare.7, plus listed versions 3.1.12-tuxcare.13.1.12-tuxcare.23.1.12-tuxcare.33.1.12-tuxcare.43.1.12-tuxcare.53.1.12-tuxcare.6 |
3.1.12-tuxcare.7 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.1.12 up to 3.1.12-tuxcare.7, plus listed versions 3.1.12-tuxcare.13.1.12-tuxcare.23.1.12-tuxcare.33.1.12-tuxcare.43.1.12-tuxcare.53.1.12-tuxcare.6 |
3.1.12-tuxcare.7 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.3.16 up to 2.3.16-tuxcare.2, plus listed versions 2.3.16-tuxcare.1 |
2.3.16-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.3.16 up to 2.3.16-tuxcare.2, plus listed versions 2.3.16-tuxcare.1 |
2.3.16-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 6 CVEs |
3.1.11 up to 3.1.11-tuxcare.1 | 3.1.11-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 6 CVEs |
3.1.11 up to 3.1.11-tuxcare.1 | 3.1.11-tuxcare.1 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 6 CVEs |
3.1.11 up to 3.1.11-tuxcare.1 | 3.1.11-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.3.7 up to 2.3.7-tuxcare.3, plus listed versions 2.3.7-tuxcare.12.3.7-tuxcare.2 |
2.3.7-tuxcare.3 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.3.7 up to 2.3.7-tuxcare.3, plus listed versions 2.3.7-tuxcare.12.3.7-tuxcare.2 |
2.3.7-tuxcare.3 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
3.1.8 up to 3.1.8-tuxcare.5, plus listed versions 3.1.8-tuxcare.13.1.8-tuxcare.23.1.8-tuxcare.33.1.8-tuxcare.4 |
3.1.8-tuxcare.5 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
3.1.8 up to 3.1.8-tuxcare.5, plus listed versions 3.1.8-tuxcare.13.1.8-tuxcare.23.1.8-tuxcare.33.1.8-tuxcare.4 |
3.1.8-tuxcare.5 |
org.springframework.amqp:spring-rabbit-junitTuxCare:Maven From an advisory covering 4 CVEs |
3.1.8 up to 3.1.8-tuxcare.5, plus listed versions 3.1.8-tuxcare.13.1.8-tuxcare.23.1.8-tuxcare.33.1.8-tuxcare.4 |
3.1.8-tuxcare.5 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.1.4.RELEASE up to 2.1.4.RELEASE-tuxcare.1 | 2.1.4.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.1.4.RELEASE up to 2.1.4.RELEASE-tuxcare.1 | 2.1.4.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.2, plus listed versions 2.1.8.RELEASE-tuxcare.1 |
2.1.8.RELEASE-tuxcare.2 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 3 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.2, plus listed versions 2.1.8.RELEASE-tuxcare.1 |
2.1.8.RELEASE-tuxcare.2 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
2.2.12.RELEASE up to 2.2.12.RELEASE-tuxcare.1 | 2.2.12.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
2.2.12.RELEASE up to 2.2.12.RELEASE-tuxcare.1 | 2.2.12.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 3 CVEs |
1.7.14.RELEASE up to 1.7.14.RELEASE-tuxcare.1 | 1.7.14.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-amqpTuxCare:Maven From an advisory covering 4 CVEs |
2.1.17.RELEASE up to 2.1.17.RELEASE-tuxcare.1 | 2.1.17.RELEASE-tuxcare.1 |
org.springframework.amqp:spring-rabbitTuxCare:Maven From an advisory covering 4 CVEs |
2.1.17.RELEASE up to 2.1.17.RELEASE-tuxcare.1 | 2.1.17.RELEASE-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, published | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47860 is a medium vulnerability (CVSS 6.5) in Spring Amqp, published August 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. No source names a fixed version.