The vulnerability allows an attacker who can publish to a queue to send a specially crafted compressed message that the consumer application decompresses without proper bounds. This unbounded decompression consumes excessive memory and can cause the JVM to crash, resulting in a denial of service to the affected service. The underlying weakness is an unchecked resource exhaustion during decompression, as defined by CWE-400.

Spring AMQP is affected in versions 4.1.0, 4.0.0 through 4.0.4, 3.2.0 through 3.2.12, and 2.4.18 and earlier. The flaw exists in the message consumer component that handles compressed message bodies.

The CVSS score of 6.5 indicates a moderate severity, but the exploit requires the attacker to have the ability to publish to the target queue, which may limit its reach to applications with exposed or insufficiently protected message brokers. The EPSS score is currently not available, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is likely an authenticated or misconfigured publisher, the overall risk depends largely on the access controls of the message system. Once a patched or mitigated system is compromised, the application may experience repeated service interruptions from message-induced JVM crashes.