CVEvulnerability

CVE-2026-59274

6.5 MEDIUM Published 2026-08-27 Modified 2026-09-01 Official page ↗
Status
Analyzed
Published
2026-08-27
Last modified
2026-09-01
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-409

Description

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Affected configurations

• vmware spring integration (>= 6.4.0 < 6.4.13) • vmware spring integration (>= 6.5.0 < 6.5.11) • vmware spring integration (>= 7.0.0 < 7.0.5.1) • vmware spring integration (>= 7.1.0 < 7.1.0.1)

Related

Weakness · CWE (1)

  • CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) weakness

References