CVE-2026-59274mediumCWE-409

CVE-2026-59274: falha de média gravidade em Spring Integration

Unbounded decompression in UnZipTransformer enables zip-bomb DoS

Publicada em

Seguir esta CVE+ Monitorar Spring Integration

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
Spring · Spring Integration
CVEs relacionadas — Spring Integration

No mesmo produto, das mais perigosas para as menos.

CVE-2026-47864MEDIUMUnsafe Java deserialization in SerializingHttpMessageConverter — remote code executionEPSS 5.9%CVE-2019-3772—Spring Integration XML External Entity Injection (XXE)EPSS 3.0%CVE-2026-59307HIGHDeserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale referenceEPSS 0.4%CVE-2026-59311MEDIUMFixed predictable /tmp/ziptransformer work directory enables symlink pre-creationEPSS 0.4%CVE-2026-47861MEDIUMUDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=falseEPSS 0.3%CVE-2026-47856MEDIUMJsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-listEPSS 0.3%