Spring Integration UnZipTransformer DOS via ZIP bomb pre-7.1.0
CVE-2026-59274 Published on August 27, 2026
Unbounded decompression in UnZipTransformer enables zip-bomb DoS
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Vulnerability Analysis
CVE-2026-59274 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
What is a Data Amplification Vulnerability?
The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output. An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
CVE-2026-59274 has been classified to as a Data Amplification vulnerability or weakness.
Products Associated with CVE-2026-59274
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Integration:- Version 7.1.0 is affected.
- Version 7.0.0, <= 7.0.5 is affected.
- Version 6.5.0, <= 6.5.10 is affected.
- Version 6.4.0, <= 6.4.12 is affected.