Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization

Spring Integration XML External Entity Injection (XXE)

fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

SMB minimum protocol dialect defaults to SMB1

Unbounded decompression in UnZipTransformer enables zip-bomb DoS

Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

ZipTransformer uses file_name header to build workDirectory path without sanitization

World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)