| CVE-2026-59324 |
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads,…
|
8.2
Élevée
|
27 août 2026 |
| CVE-2026-59322 |
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor
|
6.3
Moyenne
|
27 août 2026 |
| CVE-2026-59321 |
A single ScriptEngine instance is reused for every message on a script-backed channel
|
4.2
Moyenne
|
27 août 2026 |
| CVE-2026-59311 |
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their…
|
6.8
Moyenne
|
27 août 2026 |
| CVE-2026-59307 |
An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all…
|
8.0
Élevée
|
27 août 2026 |
| CVE-2026-59293 |
Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks…
|
6.6
Moyenne
|
27 août 2026 |
| CVE-2026-59292 |
PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to…
|
3.2
Faible
|
27 août 2026 |
| CVE-2026-59274 |
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives
|
6.5
Moyenne
|
27 août 2026 |
| CVE-2026-47880 |
A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set…
|
5.4
Moyenne
|
27 août 2026 |
| CVE-2026-47864 |
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and…
|
6.4
Moyenne
|
27 août 2026 |
| CVE-2026-47861 |
An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can…
|
6.3
Moyenne
|
26 août 2026 |
| CVE-2026-47862 |
An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the…
|
5.4
Moyenne
|
26 août 2026 |
| CVE-2026-47859 |
RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424…
|
5.4
Moyenne
|
26 août 2026 |
| CVE-2026-47856 |
Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type,…
|
6.3
Moyenne
|
26 août 2026 |
| CVE-2026-40987 |
A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside…
|
7.1
Élevée
|
11 juin 2026 |
| CVE-2019-3772 |
Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older…
|
Non notée
|
18 janv. 2019 |