Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Spring Integration — Vulnerabilities & Security Advisories 17

All 17 CVE vulnerabilities found in Spring Integration, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerability data for Spring Integration, a core Spring Framework module used for messaging and integration patterns, categorized by specific weakness types. The collection encompasses publicly disclosed security flaws affecting this product, spanning the full timeline from its initial release through the most recent advisory updates. Readers can utilize this data to track vendor-issued advisories, analyze recurring weakness classes within the ecosystem, or review the historical vulnerability profile of the integration layer. By centralizing these records, the page provides a structured view of how the product's security posture has evolved, highlighting periods of increased disclosure activity and the specific nature of the exploited or mitigated weaknesses. This aggregation supports security teams in assessing risk exposure, comparing remediation timelines, and identifying patterns in the types of vulnerabilities typically associated with complex message routing and transformation components. The focus remains strictly on factual data presentation, enabling users to filter results by vulnerability severity, discovery date, or specific technical classification to gain a comprehensive understanding of the product's security landscape without reliance on individual, scattered announcement sources.

Vendor: Spring

CVE ID Title CVSS Severity Published
CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction 8.2 High 2026-08-27
CVE-2026-59322 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders 6.3 Medium 2026-08-27
CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check 4.2 Medium 2026-08-27
CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation 6.8 Medium 2026-08-27
CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference 8.0 High 2026-08-27
CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1 6.6 Medium 2026-08-27
CVE-2026-59292 World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) 3.2 Low 2026-08-27
CVE-2026-59274 Unbounded decompression in UnZipTransformer enables zip-bomb DoS 6.5 Medium 2026-08-27
CVE-2026-47880 DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names 5.4 Medium 2026-08-27
CVE-2026-47864 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution 6.4 Medium 2026-08-27
CVE-2026-47861 UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false 6.3 Medium 2026-08-26
CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization 5.4 Medium 2026-08-26
CVE-2026-47859 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS 5.4 Medium 2026-08-26
CVE-2026-47856 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list 6.3 Medium 2026-08-26
CVE-2026-40987 Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization CWE-22 7.1 High 2026-06-11
CVE-2020-5413 Kryo Configuration Allows Code Execution with Unknown "Serialization Gadgets" CWE-502 9.8 - 2020-07-31
CVE-2019-3772 Spring Integration XML External Entity Injection (XXE) CWE-611 9.8 - 2019-01-18

All 17 known CVE vulnerabilities affecting Spring Integration with full Chinese analysis, references, and POCs where available.