Threats Tagged 'ghsa-jmqv-c2qw-xw7r'

CVE-2026-59274 is a medium severity vulnerability in Spring Integration's UnZipTransformer component. The vulnerability arises because the component does not limit the decompressed size or number of entries when processing zip archives. An attacker can exploit this by sending a specially crafted zip archive that exhausts JVM heap memory, resulting in a denial-of-service (DoS) condition. This affects specific versions of Spring Integration including 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and exactly 7.1.0. No official patch or remediation guidance is currently provided. No known exploits are reported in the wild.