What’s Vulnerable › Products

Spring Integration vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your Spring Integration version is affected

Latest Spring Integration vulnerabilities

• CVE-2026-59324 — fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction (CVSS 8.2)
• CVE-2026-59322 — EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders (CVSS 6.3)
• CVE-2026-59321 — Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check (CVSS 5.4)
• CVE-2026-59311 — Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation (CVSS 6.8)
• CVE-2026-59307 — Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference (CVSS 8.0)
• CVE-2026-59293 — SMB minimum protocol dialect defaults to SMB1 (CVSS 6.6)
• CVE-2026-59292 — World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) (CVSS 3.2)
• CVE-2026-59274 — Unbounded decompression in UnZipTransformer enables zip-bomb DoS (CVSS 6.5)
• CVE-2026-47880 — DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names (CVSS 5.4)
• CVE-2026-47864 — Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution (CVSS 9.8)
• CVE-2026-47862 — ZipTransformer uses file_name header to build workDirectory path without sanitization (CVSS 5.4)
• CVE-2026-47861 — UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false (CVSS 6.3)
• CVE-2026-47859 — Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS (CVSS 6.5)
• CVE-2026-47856 — JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list (CVSS 6.3)
• CVE-2026-40987 — Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization (CVSS 7.1)
• CVE-2020-5413 — Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets" (CVSS 9.8)
• CVE-2019-3772 — Spring Integration XML External Entity Injection (XXE) (CVSS 9.8)