6.5
Medium
CVE-2026-59274 The UnZipTransformer does not limit decompressed entry size or entry count when processing archives
Description
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Integration | 7.1.0 | No fix stated |
| Spring Integration 7.0 | 7.0.0 → 7.0.5 | No fix stated |
| Spring Integration 6.5 | 6.5.0 → 6.5.10 | No fix stated |
| Spring Integration 6.4 | 6.4.0 → 6.4.12 | No fix stated |
References
- spring.io spring.io
Timeline
- Published
- Last modified
Other CVEs of Spring Integration
The 16 CVEs of Spring Integration →
CVE-2026-59324
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads,…
8.2
High
CVE-2026-59322
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor
6.3
Medium
CVE-2026-59321
A single ScriptEngine instance is reused for every message on a script-backed channel
4.2
Medium
CVE-2026-59311
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their…
6.8
Medium