SI
Product
Spring Integration
17
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 3Medium 10Low 1
Watch
Add Spring Integration to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-59311 | 6.8 | Aug 27 | Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation Affected: 6.4.0 through 6.4.12; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5; 7.1.0; 7.1.0; 7.1.0; +2 more |
| CVE-2026-59293 | 6.6 | Aug 27 | SMB minimum protocol dialect defaults to SMB1 Affected: 6.4.0 before 6.4.13; 6.5.0 before 6.5.11; 7.0.0 before 7.0.5.1; 7.1.0 before 7.1.0.1 |
| CVE-2026-59274 | 6.5 | Aug 27 | Unbounded decompression in UnZipTransformer enables zip-bomb DoS Affected: 6.4.0 before 6.4.13; 6.5.0 before 6.5.11; 7.0.0 before 7.0.5.1; 7.1.0 before 7.1.0.1 |
| CVE-2026-47859 | 6.5 | Aug 26 | Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS Affected: before 5.5.22; 6.4.0 before 6.4.13; 6.5.0 before 6.5.11; 7.0.0 before 7.0.5.1; 7.1.0 before 7.1.0.1 |
| CVE-2026-59322 | 6.3 | Aug 27 | EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders Affected: before 5.5.22; 6.4.0 before 6.4.13; 6.5.0 before 6.5.11; 7.0.0 before 7.0.5.1; 7.1.0 before 7.1.0.1 |
| CVE-2026-47861 | 6.3 | Aug 26 | UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false Affected: before 5.5.22; 6.4.0 before 6.4.13; 6.5.0 before 6.5.11; 7.0.0 before 7.0.5.1; 7.1.0 before 7.1.0.1 |
| CVE-2026-47856 | 6.3 | Aug 26 | JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list Affected: before 5.5.22; 6.4.0 before 6.4.13; 6.5.0 before 6.5.11; 7.0.0 before 7.0.5.1; 7.1.0 before 7.1.0.1 |
| CVE-2026-59321 | 5.4 | Aug 27 | Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check Affected: through 5.5.21; 6.4.0 through 6.4.12; 6.5.0 through 6.5.10; 7.0.0 before 7.0.5.1; 7.1.0 before 7.1.0.1 |
| CVE-2026-47880 | 5.4 | Aug 27 | DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names Affected: before 5.5.22; 6.4.0 before 6.4.13; 6.5.0 before 6.5.11; 7.0.0 before 7.0.5.1; 7.1.0 before 7.1.0.1 |
| CVE-2026-47862 | 5.4 | Aug 26 | ZipTransformer uses file_name header to build workDirectory path without sanitization Affected: 6.4.0 before 6.4.13; 6.5.0 before 6.5.11; 7.0.0 before 7.0.5.1; 7.1.0 before 7.1.0.1 |
Showing 10