Executive brief
Spring AMQP is a messaging library used by Java applications to communicate over message queues. When message decompression is enabled, an attacker who can publish messages to the queue can send a small (~1 MB) specially crafted compressed message that crashes the consumer application's JVM, causing a denial of service. This could disrupt critical business processes that rely on message-based communication.
Technical details
This is a decompression bomb (zip bomb) vulnerability in Spring AMQP's message decompression handling. When an application enables automatic message decompression, the library attempts to decompress incoming messages without proper size limits or decompression ratio checks. An attacker with publish access to the queue can send a highly-compressed payload that expands to enormous size during decompression, exhausting JVM heap memory and causing an out-of-memory error that crashes the consumer process. The vulnerability requires the target application to have message decompression enabled and the attacker to have network or queue access to publish messages. Patches are available in Spring AMQP 4.1.1, 4.0.5, and 3.2.13.
Affected products
- Spring AMQP 2.4.18 and earlier, 3.2.0–3.2.12, 4.0.0–4.0.4, 4.1.0
Timeline
- 2026-08-27: disclosed: CVE-2026-47860 published