Spring Spring Integration
16 CVEs affecting Spring Spring Integration. Latest disclosed: 2026-08-27. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3772 | Critical | 9.8 | 2019-01-18 | Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible… |
CVE-2026-59324 | High | 8.2 | 2026-08-27 | When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessage… |
CVE-2026-59307 | High | 8.0 | 2026-08-27 | An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bea… |
CVE-2026-40987 | High | 7.1 | 2026-06-11 | A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attack… |
CVE-2026-59311 | Medium | 6.8 | 2026-08-27 | A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer… |
CVE-2026-59293 | Medium | 6.6 | 2026-08-27 | Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vuln… |
CVE-2026-59274 | Medium | 6.5 | 2026-08-27 | The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can… |
CVE-2026-47864 | Medium | 6.4 | 2026-08-27 | SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with C… |
CVE-2026-59322 | Medium | 6.3 | 2026-08-27 | The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte pay… |
CVE-2026-47861 | Medium | 6.3 | 2026-08-27 | An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP da… |
CVE-2026-47856 | Medium | 6.3 | 2026-08-27 | Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a cl… |
CVE-2026-47880 | Medium | 5.4 | 2026-08-27 | A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, erro… |
CVE-2026-47862 | Medium | 5.4 | 2026-08-27 | An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive… |
CVE-2026-47859 | Medium | 5.4 | 2026-08-27 | RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet cou… |
CVE-2026-59321 | Medium | 4.2 | 2026-08-27 | A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. th… |
CVE-2026-59292 | Low | 3.2 | 2026-08-27 | PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.pr… |