Spring Spring Integration
16 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-59324 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction | HIGH 8.2 | 0.3 % | ||
| CVE-2026-59322 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-59321 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-59311 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation | MEDIUM 6.8 | 0.4 % | ||
| CVE-2026-59307 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference | HIGH 8.0 | 0.4 % | ||
| CVE-2026-59293 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | SMB minimum protocol dialect defaults to SMB1 | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-59292 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions) | LOW 3.2 | 0.1 % | ||
| CVE-2026-59274 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | Unbounded decompression in UnZipTransformer enables zip-bomb DoS | MEDIUM 6.5 | 0.4 % | ||
| CVE-2026-47880 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-47864 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution | CRITICAL 9.8 | 5.9 % | ||
| CVE-2026-47861 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-47862 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | ZipTransformer uses file_name header to build workDirectory path without sanitization | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-47859 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-47856 | 7.1.0 ; 7.0.0 – 7.0.5 ; 6.5.0 – 6.5.10 ; … | JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-40987 | 7.0.0 – < 7.0.4.1 ; 6.5.0 – < 6.5.8.1 ; 6.4.0 – < 6.4.12 ; … | Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization | HIGH 7.1 | 0.2 % | ||
| CVE-2019-3772 | 5.0 – < v5.0.10.RELEASE ; 5.1 – < v5.1.1.RELEASE ; 4.3 – < v4.3.18.RELEASE | Spring Integration XML External Entity Injection (XXE) | CRITICAL 9.8 | 3.0 % |