CVE-2026-59274 Unbounded decompression in UnZipTransformer enables zip-bomb DoS
Attackers can cause denial of service by sending zip bombs to Spring Integration's UnZipTransformer, exhausting JVM memory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59274?
CVE-2026-59274 is a medium-severity denial of service vulnerability in Spring Integration, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
Weakness: CWE-409
Which versions are affected by CVE-2026-59274?
It affects 1 product.
Products include Vmware Spring Integration.
How do I fix CVE-2026-59274?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-59274 being exploited?
There is no known exploitation of CVE-2026-59274 in the wild and no public exploit code.
Other vulnerabilities in Spring Integration
- CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
- CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
- CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
- CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
- CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1
Sources
Also known as GHSA-jmqv-c2qw-xw7r.