CVE-2026-59274

Name of the Vulnerable Software and Affected Versions Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration version 7.1.0

Description The UnZipTransformer does not limit the decompressed entry size or the entry count when processing archives. This allows an attacker to send a specially crafted zip archive, known as a zip-bomb, which can exhaust the JVM heap memory and lead to a denial-of-service outage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.