Spring Integration (Spring) - vulnerabilities (CVEs)
16 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2026-08-27. Vendor: Spring.
CVEs of Spring Integration
- CVE-2026-59324 - CVSS 8.2 (high), 2026-08-27: When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same…
- CVE-2026-59322 - CVSS 6.3 (medium), 2026-08-27: The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte…
- CVE-2026-59321 - CVSS 5.4 (medium), 2026-08-27: A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g.…
- CVE-2026-59311 - CVSS 6.8 (medium), 2026-08-27: A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating…
- CVE-2026-59307 - CVSS 8 (high), 2026-08-27: An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed…
- CVE-2026-59293 - CVSS 6.6 (medium), 2026-08-27: Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is…
- CVE-2026-59292 - CVSS 3.2 (low), 2026-08-27: PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to…
- CVE-2026-59274 - CVSS 6.5 (medium), 2026-08-27: The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can…
- CVE-2026-47880 - CVSS 5.4 (medium), 2026-08-27: A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel,…
- CVE-2026-47864 - CVSS 9.8 (critical), 2026-08-27: SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with…
- CVE-2026-47861 - CVSS 6.3 (medium), 2026-08-26: An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP…
- CVE-2026-47862 - CVSS 5.4 (medium), 2026-08-26: An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive…
- CVE-2026-47859 - CVSS 6.5 (medium), 2026-08-26: RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet…
- CVE-2026-47856 - CVSS 6.3 (medium), 2026-08-26: Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a…
- CVE-2026-40987 - CVSS 7.1 (high), 2026-06-11: A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with…
- CVE-2019-3772 - CVSS 9.8 (critical), 2019-01-18: Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were…
