6.5
Moyenne
CVE-2026-47860 An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the…
Description
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring AMQP | 4.1.0 | Pas de correctif indiqué |
| Spring AMQP 4.0 | 4.0.0 → 4.0.4 | Pas de correctif indiqué |
| Spring AMQP 3.2 | 3.2.0 → 3.2.12 | Pas de correctif indiqué |
| Spring AMQP 2.4 | premières → 2.4.18 | Pas de correctif indiqué |
Références
- spring.io spring.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring AMQP
Les 8 CVE de Spring AMQP →
CVE-2026-59320
When a container-level ErrorHandler is configured (the mitigation for finding 221000), each delivery whose processing…
6.5
Moyenne
CVE-2026-59272
Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is…
6.8
Moyenne
CVE-2026-59275
A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread —…
6.6
Moyenne
CVE-2026-59271
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown…
5.3
Moyenne