Quick answers
- Is CVE-2026-47860 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-47860 being exploited in the wild.
- How severe is CVE-2026-47860?
- Medium severity, with a CVSS score of 6.5, published 27 August 2026.
- Which products and versions are affected?
- Spring AMQP 2.4.18 and earlier, 3.2.0–3.2.12, 4.0.0–4.0.4, 4.1.0.
- Is there a fix for CVE-2026-47860?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-47860 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-47860?
- Check whether you run Spring AMQP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a decompression bomb (zip bomb) vulnerability in Spring AMQP's message decompression handling. When an application enables automatic message decompression, the library attempts to decompress incoming messages without proper size limits or decompression ratio checks. An attacker with publish access to the queue can send a highly-compressed payload that expands to enormous size during decompression, exhausting JVM heap memory and causing an out-of-memory error that crashes the consumer process. The vulnerability requires the target application to have message decompression enabled and the attacker to have network or queue access to publish messages. Patches are available in Spring AMQP 4.1.1, 4.0.5, and 3.2.13.
Affected products
- Spring AMQP 2.4.18 and earlier, 3.2.0–3.2.12, 4.0.0–4.0.4, 4.1.0
Timeline
- 2026-08-27: disclosed: CVE-2026-47860 published