SI
Product
Spring Integration
16
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 3Medium 10Low 1
Watch
Add Spring Integration to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-47864 | 9.8 | Aug 27 | Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; through 5.5.21 |
| CVE-2019-3772 | 9.8 | Jan 18 | Spring Integration XML External Entity Injection (XXE) Affected: 5.0 before v5.0.10.RELEASE; 5.1 before v5.1.1.RELEASE; 4.3 before v4.3.18.RELEASE |
| CVE-2026-59324 | 8.2 | Aug 27 | fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; through 5.5.21 |
| CVE-2026-59307 | 8.0 | Aug 27 | Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12 |
| CVE-2026-40987 | 7.1 | Jun 11 | Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization Affected: 7.0.0 before 7.0.4.1; 6.5.0 before 6.5.8.1; 6.4.0 before 6.4.12; 6.3.0 before 6.3.15; 5.5.0 before 5.5.21 |
| CVE-2026-59311 | 6.8 | Aug 27 | Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12 |
| CVE-2026-59293 | 6.6 | Aug 27 | SMB minimum protocol dialect defaults to SMB1 Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12 |
| CVE-2026-59274 | 6.5 | Aug 27 | Unbounded decompression in UnZipTransformer enables zip-bomb DoS Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12 |
| CVE-2026-47859 | 6.5 | Aug 26 | Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; through 5.5.21 |
| CVE-2026-59322 | 6.3 | Aug 27 | EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; through 5.5.21 |
| CVE-2026-47861 | 6.3 | Aug 26 | UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; through 5.5.21 |
| CVE-2026-47856 | 6.3 | Aug 26 | JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; through 5.5.21 |
| CVE-2026-59321 | 5.4 | Aug 27 | Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; through 5.5.21 |
| CVE-2026-47880 | 5.4 | Aug 27 | DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; through 5.5.21 |
| CVE-2026-47862 | 5.4 | Aug 26 | ZipTransformer uses file_name header to build workDirectory path without sanitization Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12 |
| CVE-2026-59292 | 3.2 | Aug 27 | World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) Affected: 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; through 5.5.21 |
Showing 16