CVE-2026-59274

Analyzed Analyzed - Analysis Complete

Heap Exhaustion in Spring Integration

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59274

EUVD

EUVD-2026-66848

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_integration	From 6.4.0 (inc) to 6.4.13 (exc)
vmware	spring_integration	From 6.5.0 (inc) to 6.5.11 (exc)
vmware	spring_integration	From 7.0.0 (inc) to 7.0.5.1 (exc)
vmware	spring_integration	From 7.1.0 (inc) to 7.1.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

This vulnerability involves the UnZipTransformer in Spring Integration, which fails to restrict the size or number of decompressed entries in zip archives. Attackers can exploit this by sending a specially crafted zip file that consumes excessive JVM heap memory, causing a denial-of-service outage.

Detection Guidance

Detecting this vulnerability requires checking if your system uses an affected version of Spring Integration. Inspect the version in your project dependencies or configuration files. For example, use commands like 'mvn dependency:tree' for Maven or 'gradle dependencies' for Gradle to identify the Spring Integration version.

Impact Analysis

The vulnerability can lead to system crashes or slowdowns due to excessive memory consumption. If exploited, it may disrupt services relying on Spring Integration, causing downtime and potential loss of functionality for applications processing zip files.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service attacks that disrupt services handling personal or health data. A DoS outage may lead to unauthorized access or data processing delays, violating availability requirements under these regulations.

Mitigation Strategies

Upgrade to a fixed version of Spring Integration immediately. For open-source versions, upgrade to 7.1.1, 7.0.6, 6.5.11, or 6.4.13. If using enterprise versions, apply patches 7.1.0.1 or 7.0.5.1. No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59274. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70