Spring Spring Integration

• CVE-2026-59324 High 8.2 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction 0.3%
• CVE-2026-59322 Medium 6.3 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders 0.3%
• CVE-2026-59321 Medium 4.2 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check 0.2%
• CVE-2026-59311 Medium 6.8 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation 0.4%
• CVE-2026-59307 High 8.0 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference 0.4%
• CVE-2026-59293 Medium 6.6 SMB minimum protocol dialect defaults to SMB1 0.2%
• CVE-2026-59292 Low 3.2 World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) 0.1%
• CVE-2026-59274 Medium 6.5 Unbounded decompression in UnZipTransformer enables zip-bomb DoS 0.4%
• CVE-2026-47880 Medium 5.4 DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names 0.3%
• CVE-2026-47864 Medium 6.4 Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution 5.9%
• CVE-2026-47861 Medium 6.3 UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false 0.3%
• CVE-2026-47862 Medium 5.4 ZipTransformer uses file_name header to build workDirectory path without sanitization 0.3%
• CVE-2026-47859 Medium 5.4 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS 0.3%
• CVE-2026-47856 Medium 6.3 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list 0.3%
• CVE-2026-40987 High 7.1 Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization 0.2%