cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. The default JavaLangErrorHandler calls System.exit(99) on OutOfMemoryError, so the entire application terminates; combined with redelivery on restart, one poison message can crash-loop the service until an operator manually purges it.

Spring Security Advisoriesで読む

2026/08/20 09:00、Spring Security Advisoriesが「cve-2026-47860 - MEDIUM - Unbounded decompression of attacker-supplied compressed message bodies」を公開しました (種別: 脆弱性アドバイザリ)。関連する技術: Spring、Java。CVE: CVE-2026-47860。