shiro-cve-2020-17523

Apache Shiro Two Postures Authentication Bypass Analysis CVE-2020-17523 0x01 Vulnerability Description Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro's easy-to-understand API, you can...

CVE-2026-40987

CVE-2026-40987: Spring Integration Remote File Synchronization Path Traversal PoC This repository is a minimal reproduction PoC for CVE-2026-40987, as disclosed in the official Spring Security Advisory. Official advisory: https://spring.io/security/cve-2026-40987/ Official title: Remote-file...

This Week in Spring - September 29th, 2026

Hi, Spring fans! Welcome to another rip-roarin' and exciting installment of This Week in Spring! We've got a ton of cool stuff to look at this week, so let's dive right into it! an important update on Spring's release practice Speaking of which, we had a slew of releases on the 24th, including...

ROOT-APP-MAVEN-AIKIDO-2026-748560 AIKIDO-2026-748560 in org.springframework.integration:spring-integration-core - Patched by Root

Root has patched AIKIDO-2026-748560 in the org.springframework.integration:spring-integration-core package for Root:Maven. Multiple fixed versions available...

CVE-2026-59292

A flaw was found in Spring Integration. The PropertiesPersistingMetadataStore component, which is the default file-based ConcurrentMetadataStore, creates a metadata file with world-readable permissions. This allows a local attacker to read the contents of the metadata-store.properties file, leadi...

CVE-2026-47861

A flaw was found in Spring Integration. An unauthenticated remote attacker can exploit this by sending a specially crafted UDP packet to a Spring Integration UDP inbound adapter. This allows the attacker to cause the server to emit an outbound UDP datagram to any internal or external host and por...

ROOT-APP-MAVEN-CVE-2026-40987 CVE-2026-40987 in org.springframework.integration:spring-integration-file - Patched by Root

Root has patched CVE-2026-40987 in the org.springframework.integration:spring-integration-file package for Root:Maven. Multiple fixed versions available...

Improper Input Validation

Spring Integration is vulnerable to Improper Input Validation. The vulnerability is due to a non-thread-safe ScriptEngine instance being reused across concurrent message processing, potentially causing message data leakage between script evaluations or spurious exceptions...

Improper Preservation Of Message Metadata

Spring Integration is vulnerable to improper preservation of message metadata. The vulnerability is due to reply and propagated headers being copied from the most recently consumed upstream message when .fluxTransform processes raw payloads asynchronously or out of order, which allows an attacker...

Man-in-the-Middle

Spring Integration is vulnerable to Man-in-the-Middle attacks. The vulnerability is due to the jCIFS client negotiating down to SMB1/CIFS unless the application explicitly raises smbMinVersion, where SMB1/CIFS lacks mandatory signing/encryption and attackers can perform NTLM relay and...

Improper Handling Of Untrusted Message Headers

Spring Integration is vulnerable to improper handling of untrusted message headers. The vulnerability is due to the EmbeddedHeadersJsonMessageMapper deserializing embedded JSON headers into a Map and creating message headers without sanitizing or filtering untrusted header names by default, which...

Denial Of Service

Spring Integration is vulnerable to Denial of Service. The vulnerability is due to the UnZipTransformer not limiting decompressed entry size or entry count when processing archives, where an attacker can send a crafted zip archive that exhausts JVM heap memory and causes a denial-of-service outag...

Deserialization Protection Bypass

org.springframework.integration, spring-integration-jdbc is vulnerable to a deserialization protection bypass. The vulnerability is due to JdbcMessageStore.addAllowedPatterns... providing no effective protection when the store is configured as a Spring-managed bean, which allows an attacker to...

CVE-2026-59324

A flaw was found in Spring Integration. When an IntegrationFlow uses .fluxTransform with an asynchronous fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription can have their reply headers copied from other messages. This information disclosure...

CVE-2026-47864

A flaw was found in Spring Integration. The SerializingHttpMessageConverter component deserializes incoming HTTP request bodies without proper class filtering. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request. If a known Java deserialization 'gadget'...

Authorization Bypass

Spring Integration is vulnerable to Authorization Bypass. The vulnerability is due to JMS properties such as replyChannel, errorChannel, and jsonTypeId being copied without validation into Spring Integration MessageHeaders, which allows an attacker with JMS publish access to manipulate message...

CLSA-2026-1788820092 TuxCare security update for org.springframework.integration (5 CVEs)

TuxCare rebuilt 39 org.springframework.integration packages to address 5 CVEs. Fixed in 5.5.20-tuxcare.6...

Deserialization Of Untrusted Data

Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to SerializingHttpMessageConverter deserializing HTTP request bodies using ObjectInputStream.readObject without class filtering, which allows an unauthenticated attacker to provide a crafted serialized...

Server-Side Request Forgery (SSRF)

Spring Integration is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of UDP inbound adapter requests, which allows an unauthenticated attacker to send a crafted UDP packet and cause the server to send UDP datagrams to arbitrary internal or...

Deserialization Of Untrusted Data

Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the jsonTypeId header being used to determine the deserialization target class without a type or package allow-list, which allows an attacker to specify a malicious class and potentially achieve...