Overview
About vulnerability
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. The default JavaLangErrorHandler calls System.exit(99) on OutOfMemoryError, so the entire application terminates; combined with redelivery on restart, one poison message can crash-loop the service until an operator manually purges it.Details
- Affected product:
- Spring
- Affected packages:
- Spring Integration @ 5.5.19 (+1741 more)