CVE-2026-59274

Summary

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Affected Software

VendorProductVersion RangeStatus
SpringSpring Integration7.1.0affected
SpringSpring Integration7.0.0 <= 7.0.5affected
SpringSpring Integration6.5.0 <= 6.5.10affected
SpringSpring Integration6.4.0 <= 6.4.12affected

Weaknesses

  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification, Decompression Bomb)

References