CVE-2026-59274
Received Received - Intake

Heap Exhaustion in Spring Integration

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-59274
EUVD
EUVD-2026-66848

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
spring integration 7.1.0
spring integration From 7.0.0 (inc) to 7.0.5 (inc)
spring integration From 6.5.0 (inc) to 6.5.10 (inc)
spring integration From 6.4.0 (inc) to 6.4.12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the UnZipTransformer in Spring Integration, which fails to restrict the size or number of decompressed entries in zip archives. Attackers can exploit this by sending a specially crafted zip file that consumes excessive JVM heap memory, causing a denial-of-service outage.

Detection Guidance

Detecting this vulnerability requires checking if your system uses an affected version of Spring Integration. Inspect the version in your project dependencies or configuration files. For example, use commands like 'mvn dependency:tree' for Maven or 'gradle dependencies' for Gradle to identify the Spring Integration version.

Impact Analysis

The vulnerability can lead to system crashes or slowdowns due to excessive memory consumption. If exploited, it may disrupt services relying on Spring Integration, causing downtime and potential loss of functionality for applications processing zip files.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service attacks that disrupt services handling personal or health data. A DoS outage may lead to unauthorized access or data processing delays, violating availability requirements under these regulations.

Mitigation Strategies

Upgrade to a fixed version of Spring Integration immediately. For open-source versions, upgrade to 7.1.1, 7.0.6, 6.5.11, or 6.4.13. If using enterprise versions, apply patches 7.1.0.1 or 7.0.5.1. No additional mitigation steps are required beyond upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart