CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-47859 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...

CVE-2026-47859

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...

CVE-2026-47859 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...

CVE-2026-47859

CVE-2026-47859 affects Spring Integration 's RFC6587SyslogDeserializer , the component used by the syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames. The root cause is that the deserializer trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array o...

CVE-2026-47859 Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring...

CVE-2026-47856

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

CVE-2026-47856 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

CVE-2026-47856

Spring Integration 's JsonToObjectTransformer deserializes JSON messages by resolving the json__TypeId__ message header to a target class via ClassUtils.forName, with no type or package allow-list to constrain the resolved class. This allows an attacker with low privileges to supply an arbitrary ...

CVE-2026-47856 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

CVE-2026-47856 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0...

CVE-2026-47852

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-47852 Predictable cache directory location allows local ONNX model substitution in Spring AI

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-47852 Predictable cache directory location allows local ONNX model substitution in Spring AI

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-47852 Predictable cache directory location allows local ONNX model substitution in Spring AI

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-47852

CVE-2026-47852 affects Spring AI (versions 1.0.0–1.0.9 , 1.1.0–1.1.8 , and 2.0.0 ). A local attacker on a multi-user host can exploit a predictable (deterministic) cache directory path by pre-creating it and planting a malicious ONNX model file , leading to integrity impact as rated by the vendor...

CVE-2026-47851

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-47851 Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...

CVE-2026-47851

CVE-2026-47851 is a denial-of-service vulnerability in the Spring AI PDF Document Reader . When analyzing a PDF whose table of contents (outline tree) is deeply nested or cyclic, unbounded recursion triggers a StackOverflowError in the ingestion thread. The attack requires no privileges or user i...

CVE-2026-47851 Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9...