Product by Spring
Spring Integration
16 known vulnerabilities in Spring Integration (Spring), 0 of them actively exploited (CISA KEV).
Key figures
16
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-47864 | Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution | 6.4 | |
| Critical | CVE-2019-3772 | Spring Integration XML External Entity Injection (XXE) | 9.8 | |
| High | CVE-2026-59307 | Spring Integration: Deserialization of Untrusted Data | 8.0 | |
| High | CVE-2026-59324 | Spring Integration: security vulnerability | 8.2 | |
| Medium | CVE-2026-59274 | Unbounded decompression in UnZipTransformer enables zip-bomb DoS | 6.5 | |
| Medium | CVE-2026-59311 | Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation | 6.8 | |
| Medium | CVE-2026-47861 | Spring Integration: security vulnerability | 6.3 | |
| Medium | CVE-2026-47856 | Spring Integration: Deserialization of Untrusted Data | 6.3 | |
| Medium | CVE-2026-59322 | EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders | 6.3 | |
| Medium | CVE-2026-59293 | SMB minimum protocol dialect defaults to SMB1 | 6.6 | |
| Medium | CVE-2026-47862 | ZipTransformer uses file_name header to build workDirectory path without sanitization | 5.4 | |
| High | CVE-2026-40987 | Spring Integration: Path Traversal | 7.1 | |
| Medium | CVE-2026-47859 | Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS | 5.4 | |
| Medium | CVE-2026-47880 | Spring Integration: security vulnerability | 5.4 | |
| Medium | CVE-2026-59321 | Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check | 4.2 | |
| Low | CVE-2026-59292 | World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) | 3.2 |