PT-2026-82354
CVE-2026-47860
·
تاريخ النشر
2026-08-26
·
تاريخ التحديث
2026-08-28
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions
Spring AMQP version 4.1.0
Spring AMQP versions 4.0.0 through 4.0.4
Spring AMQP versions 3.2.0 through 3.2.12
Spring AMQP versions 2.4.18 and earlier
Description
An attacker capable of publishing to a queue consumed by an application with message decompression enabled can cause the consumer JVM (Java Virtual Machine) to crash by sending a single message of approximately 1 MB. This occurs due to unbounded decompression of attacker-supplied compressed message bodies.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
قابلية الاستغلال
استغلال
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾