Spring Integration vulnerabilities

• spring integration, vmware spring integration +1 more fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction CVE-2026-59324 8.2 HighAugust 27, 2026
• spring integration, vmware spring integration +1 more EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders CVE-2026-59322 Fix available 6.3 MediumAugust 27, 2026
• spring integration, vmware spring integration +1 more Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check CVE-2026-59321 4.2 MediumAugust 27, 2026
• spring integration, vmware spring integration +1 more Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation CVE-2026-59311 6.8 MediumAugust 27, 2026
• spring integration, vmware spring integration +1 more Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference CVE-2026-59307 8.0 HighAugust 27, 2026
• spring integration, vmware spring integration +1 more SMB minimum protocol dialect defaults to SMB1 CVE-2026-59293 6.6 MediumAugust 27, 2026
• spring integration, vmware spring integration +1 more World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) CVE-2026-59292 3.2 LowAugust 27, 2026
• spring integration, vmware spring integration +1 more Unbounded decompression in UnZipTransformer enables zip-bomb DoS CVE-2026-59274 6.5 MediumAugust 27, 2026
• spring integration, vmware spring integration +1 more DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names CVE-2026-47880 5.4 MediumAugust 27, 2026
• spring integration, vmware spring integration +1 more Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution CVE-2026-47864 6.4 MediumAugust 27, 2026
• spring integration, vmware spring integration +1 more UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false CVE-2026-47861 6.3 MediumAugust 26, 2026
• spring integration, vmware spring integration +1 more ZipTransformer uses file_name header to build workDirectory path without sanitization CVE-2026-47862 5.4 MediumAugust 26, 2026
• spring integration, vmware spring integration +1 more Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS CVE-2026-47859 5.4 MediumAugust 26, 2026
• spring integration, vmware spring integration +1 more JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list CVE-2026-47856 Fix available 6.3 MediumAugust 26, 2026
• spring integration, vmware spring integration +1 more Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization CVE-2026-40987 Public exploitFix available 7.1 HighJune 11, 2026
• spring integration, vmware spring integration, oracle retail customer management and segmentation foundation +2 more Spring Integration XML External Entity Injection (XXE) CVE-2019-3772 Fix available 9.8 CriticalJanuary 18, 2019