Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the RFC6587SyslogDeserializer. An attacker can cause excessive memory consumption and potentially exhaust system resources by sending frames with arbitrarily large declared lengths...

org.springframework.cloud.fn:spring-syslog-supplier (6.0.0), org.springframework.cloud.fn:spring-tcp-common (6.0.0) +7 more potentially affected by CVE-2026-47861 via org.springframework.integration:spring-integration-ip (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-ip MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.5 Source cves: CVE-2026-47861 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19267411...

org.springframework.integration:spring-integration-groovy (>=7.0.0-m1, <=7.0.5) potentially affected by CVE-2026-59321 via org.springframework.integration:spring-integration-scripting (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-scripting MAVEN version =7.0.0-m1, =7.0.0-m1, =7.0.5 Source cves: CVE-2026-59321 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-19265077...

org.springframework.integration:spring-integration-groovy (7.1.0) potentially affected by CVE-2026-59321 via org.springframework.integration:spring-integration-scripting (7.1.0)

org.springframework.integration:spring-integration-scripting MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-scripting and may be impacted: -...

org.springframework.integration:spring-integration-syslog (7.1.0) potentially affected by CVE-2026-47861 via org.springframework.integration:spring-integration-ip (7.1.0)

org.springframework.integration:spring-integration-ip MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-ip and may be impacted: -...

io.gitee.gzcltech.job:job-spring-scheduler-starter-jdbc (>=4.0.0-rc3, <=4.2.4), io.github.shuigedeng:taotao-boot-demo (>=2025.02, <=2025.07) +36 more potentially affected by CVE-2026-59307 via org.springframework.integration:spring-integration-jdbc (>=6.4.0, <=7.0.5)

org.springframework.integration:spring-integration-jdbc MAVEN version =6.4.0, =4.0.0-rc3, =2025.02, =2025.02, =2025.02, =2025.02, =2025.02, =2025.02, =2025.02, =2025.02, =2025.02, =7.2.0-rc3, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =1.0.4 and more Source cves: CVE-2026-59307 Source advisory:...

com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-47862 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-59274 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the ZipTransformer process. An attacker can overwrite or plant files in arbitrary directories by pre-creating a symbolic link at /tmp/ziptransformer before the application starts, causing extracted archive contents an...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the UnZipTransformer process. An attacker can exhaust system memory and cause service outages by submitting specially crafted zip archives with excessive decompressed...

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the negotiation process. An attacker can intercept or alter files transferred and capture authentication credentials by performing a downgrade attack on the SMB protocol. Remediation...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-59322 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

cn.herodotus.dante:message-mqtt-spring-boot-starter (4.1.0.1), org.citrusframework.mvn:citrus-maven-plugin (>=5.0.0-m2, <=5.0.2) +35 more potentially affected by CVE-2026-47864 via org.springframework.integration:spring-integration-http (7.1.0)

org.springframework.integration:spring-integration-http MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-http and may be impacted: - cn.herodotus.dante:message-mqtt-spring-boot-start...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3) +730 more potentially affected by CVE-2026-47856 via org.springframework.integration:spring-integration-core (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-core MAVEN version =7.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 -...

com.bushidowallet:bushido-address-watcher (>=1.0.0, <=1.0.1), com.bushidowallet:bushido-wallet-service (>=1.0.0, <=1.0.1) +11 more potentially affected by CVE-2026-61634 via com.rabbitmq:amqp-client (3.3.4)

com.rabbitmq:amqp-client MAVEN version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.bushidowallet:bushido-address-watcher =1.0.0, =1.0.0, =0.10.0, =3.0.0, =2.14.0, =2.2.0, =5.0.3,...

com.abiquo:commons-amqp (>=2.0.0, <=3.0.0), com.bluelock:camel-spring-amqp (>=1.0, <=1.2) +2 more potentially affected by CVE-2026-61634 via com.rabbitmq:amqp-client (2.5.0)

com.rabbitmq:amqp-client MAVEN version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.abiquo:commons-amqp =2.0.0, =1.0, =2.1.0.release, =2.1.6.release Source cves: CVE-2026-61634 Source advisor...

org.graylog2:graylog2-inputs (>=0.21.0-beta2, <=0.92.0-beta.1), org.graylog2:graylog2-shared (>=0.21.0-beta2, <=0.92.0-beta.1) +2 more potentially affected by CVE-2026-61634 via com.rabbitmq:amqp-client (3.2.4)

com.rabbitmq:amqp-client MAVEN version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.graylog2:graylog2-inputs =0.21.0-beta2, =0.21.0-beta2, =1.3.0.release, =1.3.2.release -...

org.graylog2:graylog2-inputs (>=0.21.0-beta2, <=0.92.0-beta.1), org.graylog2:graylog2-shared (>=0.21.0-beta2, <=0.92.0-beta.1) +2 more potentially affected by CVE-2026-63336 via com.rabbitmq:amqp-client (3.2.4)

com.rabbitmq:amqp-client MAVEN version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.graylog2:graylog2-inputs =0.21.0-beta2, =0.21.0-beta2, =1.3.0.release, =1.3.2.release -...

org.graylog2:graylog2-inputs (>=0.21.0-beta2, <=0.92.0-beta.1), org.graylog2:graylog2-shared (>=0.21.0-beta2, <=0.92.0-beta.1) +2 more potentially affected by CVE-2026-63335 via com.rabbitmq:amqp-client (3.2.4)

com.rabbitmq:amqp-client MAVEN version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.graylog2:graylog2-inputs =0.21.0-beta2, =0.21.0-beta2, =1.3.0.release, =1.3.2.release -...

org.graylog2:graylog2-inputs (>=0.21.0-beta2, <=0.92.0-beta.1), org.graylog2:graylog2-shared (>=0.21.0-beta2, <=0.92.0-beta.1) +2 more potentially affected by CVE-2026-69219 via com.rabbitmq:amqp-client (3.2.4)

com.rabbitmq:amqp-client MAVEN version 3.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - org.graylog2:graylog2-inputs =0.21.0-beta2, =0.21.0-beta2, =1.3.0.release, =1.3.2.release -...