Skip to contentSpring By Vmware Integration vulnerabilities
- spring integration, vmware spring integration +1 morefluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionCVE-2026-593248.2 High
- spring integration, vmware spring integration +1 moreEmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeadersCVE-2026-59322Fix available6.3 Medium
- spring integration, vmware spring integration +1 moreShared JSR-223 ScriptEngine evaluated concurrently without THREADING checkCVE-2026-593214.2 Medium
- spring integration, vmware spring integration +1 moreFixed predictable /tmp/ziptransformer work directory enables symlink pre-creationCVE-2026-593116.8 Medium
- spring integration, vmware spring integration +1 moreDeserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale referenceCVE-2026-593078.0 High
- spring integration, vmware spring integration +1 moreSMB minimum protocol dialect defaults to SMB1CVE-2026-592936.6 Medium
- spring integration, vmware spring integration +1 moreWorld-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)CVE-2026-592923.2 Low
- spring integration, vmware spring integration +1 moreUnbounded decompression in UnZipTransformer enables zip-bomb DoSCVE-2026-592746.5 Medium
- spring integration, vmware spring integration +1 moreDefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant namesCVE-2026-478805.4 Medium
- spring integration, vmware spring integration +1 moreUnsafe Java deserialization in SerializingHttpMessageConverter — remote code executionCVE-2026-478646.4 Medium
- spring integration, vmware spring integration +1 moreUDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=falseCVE-2026-47861Fix available6.3 Medium
- spring integration, vmware spring integration +1 moreZipTransformer uses file_name header to build workDirectory path without sanitizationCVE-2026-478625.4 Medium
- spring integration, vmware spring integration +1 moreUnbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoSCVE-2026-478595.4 Medium
- spring integration, vmware spring integration +1 moreJsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-listCVE-2026-47856Fix available6.3 Medium
- spring integration, vmware spring integration +1 moreRemote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalizationCVE-2026-40987Public exploitFix available7.1 High
- spring by vmware integration, vmware spring integration, oracle banking corporate lending process management +6 more +8 moreKryo Configuration Allows Code Execution with Unknown "Serialization Gadgets"CVE-2020-5413Fix available9.8 Critical
- spring integration, vmware spring integration, oracle retail customer management and segmentation foundation +2 moreSpring Integration XML External Entity Injection (XXE)CVE-2019-3772Fix available9.8 Critical