Spring · product
Spring Integration
16 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.
- Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
- Spring Integration XML External Entity Injection (XXE)
- Unbounded decompression in UnZipTransformer enables zip-bomb DoS
- Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
- Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
- UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
- JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
- ZipTransformer uses file_name header to build workDirectory path without sanitization
- EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders
- Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
- fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
- DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names
- SMB minimum protocol dialect defaults to SMB1
- Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization
- Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check
- World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.