6.5
Moyenne
CVE-2026-59274 The UnZipTransformer does not limit decompressed entry size or entry count when processing archives
Description
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Integration | 7.1.0 | Pas de correctif indiqué |
| Spring Integration 7.0 | 7.0.0 → 7.0.5 | Pas de correctif indiqué |
| Spring Integration 6.5 | 6.5.0 → 6.5.10 | Pas de correctif indiqué |
| Spring Integration 6.4 | 6.4.0 → 6.4.12 | Pas de correctif indiqué |
Références
- spring.io spring.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring Integration
Les 16 CVE de Spring Integration →
CVE-2026-59324
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads,…
8.2
Élevée
CVE-2026-59322
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor
6.3
Moyenne
CVE-2026-59321
A single ScriptEngine instance is reused for every message on a script-backed channel
4.2
Moyenne
CVE-2026-59311
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their…
6.8
Moyenne