https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-59324.htmlhttps://patchthecve.com/cve/CVE-2026-59324.htmlTue, 01 Sep 2026 23:36:07 +0000HIGH 8.2: When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied fromhttps://patchthecve.com/cve/CVE-2026-59322.htmlhttps://patchthecve.com/cve/CVE-2026-59322.htmlTue, 01 Sep 2026 23:39:47 +0000MEDIUM 6.3: The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing ohttps://patchthecve.com/cve/CVE-2026-59321.htmlhttps://patchthecve.com/cve/CVE-2026-59321.htmlMon, 31 Aug 2026 17:27:25 +0000MEDIUM 4.2: A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers bindhttps://patchthecve.com/cve/CVE-2026-59311.htmlhttps://patchthecve.com/cve/CVE-2026-59311.htmlMon, 31 Aug 2026 18:06:13 +0000MEDIUM 6.8: A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Sprihttps://patchthecve.com/cve/CVE-2026-59307.htmlhttps://patchthecve.com/cve/CVE-2026-59307.htmlMon, 31 Aug 2026 18:09:32 +0000HIGH 8.0: An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12https://patchthecve.com/cve/CVE-2026-59293.htmlhttps://patchthecve.com/cve/CVE-2026-59293.htmlMon, 31 Aug 2026 23:14:00 +0000MEDIUM 6.6: Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 https://patchthecve.com/cve/CVE-2026-59292.htmlhttps://patchthecve.com/cve/CVE-2026-59292.htmlMon, 31 Aug 2026 23:07:56 +0000LOW 3.2: PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring https://patchthecve.com/cve/CVE-2026-59274.htmlhttps://patchthecve.com/cve/CVE-2026-59274.htmlTue, 01 Sep 2026 18:27:09 +0000MEDIUM 6.5: The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5https://patchthecve.com/cve/CVE-2026-47880.htmlhttps://patchthecve.com/cve/CVE-2026-47880.htmlThu, 10 Sep 2026 15:08:04 +0000MEDIUM 5.4: A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integrationhttps://patchthecve.com/cve/CVE-2026-47864.htmlhttps://patchthecve.com/cve/CVE-2026-47864.htmlWed, 02 Sep 2026 15:40:07 +0000MEDIUM 6.4: SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an applicathttps://patchthecve.com/cve/CVE-2026-47862.htmlhttps://patchthecve.com/cve/CVE-2026-47862.htmlWed, 02 Sep 2026 16:26:14 +0000MEDIUM 5.4: An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5https://patchthecve.com/cve/CVE-2026-47861.htmlhttps://patchthecve.com/cve/CVE-2026-47861.htmlWed, 02 Sep 2026 16:28:35 +0000MEDIUM 6.3: An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0https://patchthecve.com/cve/CVE-2026-47859.htmlhttps://patchthecve.com/cve/CVE-2026-47859.htmlFri, 04 Sep 2026 20:12:57 +0000MEDIUM 5.4: RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integrationhttps://patchthecve.com/cve/CVE-2026-47856.htmlhttps://patchthecve.com/cve/CVE-2026-47856.htmlFri, 04 Sep 2026 20:09:41 +0000MEDIUM 6.3: Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.https://patchthecve.com/cve/CVE-2026-40987.htmlhttps://patchthecve.com/cve/CVE-2026-40987.htmlFri, 04 Sep 2026 18:07:41 +0000HIGH 7.1: A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6