PT-2026-82700

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

PT-2026-82715

Name of the Vulnerable Software and Affected Versions Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration version 7.1.0 Description When the store is configured as a Spring-managed bea...

CVE-2026-59307: Deserialization of Untrusted Data

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

PT-2026-82698

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9...

CVE-2026-59287: Allocation of Resources Without Limits or Throttling

Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.3.0 - 1.3.9...

PT-2026-82414

Name of the Vulnerable Software and Affected Versions Spring AMQP version 4.1.0 Spring AMQP versions 4.0.0 through 4.0.4 Spring AMQP versions 3.2.0 through 3.2.12 Spring AMQP versions 2.4.18 and earlier Description When the RabbitMQ management aliveness check fails, the configured admin password ...

CVE-2026-47851: Uncontrolled Recursion

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

PT-2026-82412

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

PT-2026-82415

Name of the Vulnerable Software and Affected Versions Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration version 7.1.0 Description The UnZipTransformer does not limit the decompressed...

PT-2026-82395

Name of the Vulnerable Software and Affected Versions Spring Batch versions 6.0.0 through 6.0.4 Spring Batch versions 5.2.0 through 5.2.6 Description Applications using Jackson2ExecutionContextStringSerializer to deserialize execution contexts are susceptible to a deserialization attack when an...

CVE-2026-59306: Deserialization of Untrusted Data

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59324: Concurrent Execution using Shared Resource with Improper Synchronization

When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...

CVE-2026-47893: Generation of Error Message Containing Sensitive Information

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30...

CVE-2026-47894: Undefined Security Weakness

Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

CVE-2026-47880: Improper Input Validation

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or jsonTypeId which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration...

CVE-2026-59289: Allocation of Resources Without Limits or Throttling

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged loa...

CVE-2026-59277: Protection Mechanism Failure

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-47861: Server-Side Request Forgery (SSRF)

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 -...

CVE-2026-59274: Improper Handling of Highly Compressed Data (Data Amplification)

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration...

CVE-2026-47881: Uncontrolled Resource Consumption

Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume...