Results for "CVE-2026-47860"
Thu, August 20
cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. The default JavaLangErrorHandler calls System.exit(99) on OutOfMemoryError, so the entire application terminates; combined with redelivery on restart, one poison message can crash-loop the service until an operator manually purges it.