{"id":"spring-security-d22e8b42fe3d","seq":2067,"kind":"advisory","title":"cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies","url":"https://spring.io/security/cve-2026-47860","permalink":"https://vulnpulse.app/items/spring-security-d22e8b42fe3d","summary":"An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. The default JavaLangErrorHandler calls System.exit(99) on OutOfMemoryError, so the entire application terminates; combined with redelivery on restart, one poison message can crash-loop the service until an operator manually purges it.","severity":null,"techs":["spring","java"],"cves":["CVE-2026-47860"],"tags":["security"],"source":{"id":"spring-security","name":"Spring Security Advisories"},"published_at":"2026-08-20T00:00:00.000Z","fetched_at":"2026-10-21T16:17:45.704Z"}