PatchTheCVEspring integration vulnerabilities and fixes
Recent CVEs affecting spring integration, with upgrade or downgrade steps. 14 tracked.
Also searched as: springintegration.
spring integration has 14 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 14. Most recent: 2026-08-27. Highest priority: CVE-2026-47864 (score 46/100).
- CVE-2026-47880 MEDIUM 5.4 UPGRADE A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can s
- CVE-2026-47859 MEDIUM 5.4 UPGRADE RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC
- CVE-2026-47856 MEDIUM 6.3 UPGRADE Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization ta
- CVE-2026-47861 MEDIUM 6.3 UPGRADE An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapte
- CVE-2026-47862 MEDIUM 5.4 UPGRADE An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (t
- CVE-2026-47864 MEDIUM 6.4 UPGRADE SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInput
- CVE-2026-59322 MEDIUM 6.3 UPGRADE The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructo
- CVE-2026-59324 HIGH 8.2 UPGRADE When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payl
- CVE-2026-59274 MEDIUM 6.5 UPGRADE The UnZipTransformer does not limit decompressed entry size or entry count when processing archives
- CVE-2026-59293 MEDIUM 6.6 UPGRADE Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, whi
- CVE-2026-59292 LOW 3.2 UPGRADE PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${jav
- CVE-2026-59307 HIGH 8.0 UPGRADE An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protect
- CVE-2026-59311 MEDIUM 6.8 UPGRADE A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of t
- CVE-2026-59321 MEDIUM 4.2 UPGRADE A single ScriptEngine instance is reused for every message on a script-backed channel
FAQ
How do I fix spring integration vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is spring integration being exploited right now?
None of the tracked spring integration CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which spring integration CVE should I patch first?
CVE-2026-47864 currently ranks highest (46/100): SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInput.