ROOT-APP-MAVEN-CVE-2026-40987 CVE-2026-40987 in org.springframework.integration:spring-integration-file - Patched by Root

Root has patched CVE-2026-40987 in the org.springframework.integration:spring-integration-file package for Root:Maven. Multiple fixed versions available...

shiro-cve-2020-17523

Apache Shiro 两种姿势绕过认证分析（CVE-2020-17523） 0x01 漏洞描述 Apache Shiro是一个强大且易用的Java安全框架，执行身份验证、授权、密码和会话管理。使用Shiro的易于理解的API，您可以快速、轻松地获得任何应用程序，从最小的移动应用程序到最大的网络和企业应用程序。 当它和 Spring 结合使用时，在一定权限匹配规则下，攻击者可通过构造特殊的 HTTP 请求包完成身份认证绕过。 影响范围：Apache Shiro 1.7.1 0x02 漏洞环境搭建 shiro 1.7.0...

CVE-2026-40987

CVE-2026-40987: Spring Integration 远程文件同步路径遍历PoC 本仓库是Spring官方安全公告中公开的CVE-2026-40987的最小复现PoC。 官方公告: https://spring.io/security/cve-2026-40987/ 官方标题: Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization 严重性: High CVSS v3.1:...

Improper Preservation Of Message Metadata

Spring Integration is vulnerable to improper preservation of message metadata. The vulnerability is due to reply and propagated headers being copied from the most recently consumed upstream message when .fluxTransform processes raw payloads asynchronously or out of order, which allows an attacker...

CVE-2026-59324

A flaw was found in Spring Integration. When an IntegrationFlow uses .fluxTransform with an asynchronous fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription can have their reply headers copied from other messages. This information disclosure...

CVE-2026-47864

A flaw was found in Spring Integration. The SerializingHttpMessageConverter component deserializes incoming HTTP request bodies without proper class filtering. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request. If a known Java deserialization 'gadget'...

CLSA-2026-1788820092 TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.20-tuxcare.6...

Deserialization Of Untrusted Data

Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to SerializingHttpMessageConverter deserializing HTTP request bodies using ObjectInputStream.readObject without class filtering, which allows an unauthenticated attacker to provide a crafted serialized...

CVE-2026-59324

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

CVE-2026-59321

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

CVE-2026-59322

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

CVE-2026-59311

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-59307

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59293

Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5....

CVE-2026-59292

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

EUVD-2026-67204

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

CVE-2026-59324

Spring Integration is vulnerable to cross-message header leakage when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering fluxFunction that emits raw payloads. The root cause is a shared RequestMessageHolder , which causes concurrent requests on the same FluxMessageChannel...

CVE-2026-59322 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...