Spring Spring Integration vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 202615

Newest CVEs

• CVE-2026-59324

  fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

  Spring · Spring Integration

  High8.2
• CVE-2026-59322

  EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

  Spring · Spring Integration

  Medium6.3
• CVE-2026-59321

  Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

  Spring · Spring Integration

  Medium4.2
• CVE-2026-59311

  Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

  Spring · Spring Integration

  Medium6.8
• CVE-2026-59307

  Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

  Spring · Spring Integration

  High8.0
• CVE-2026-59293

  SMB minimum protocol dialect defaults to SMB1

  Spring · Spring Integration

  Medium6.6
• CVE-2026-59292

  World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)

  Spring · Spring Integration

  Low3.2
• CVE-2026-59274

  Unbounded decompression in UnZipTransformer enables zip-bomb DoS

  Spring · Spring Integration

  Medium6.5
• CVE-2026-47880

  DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

  Spring · Spring Integration

  Medium5.4
• CVE-2026-47864

  Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

  Spring · Spring Integration

  Medium6.4