CVE-2026-59274 PUBLISHED

Unbounded decompression in UnZipTransformer enables zip-bomb DoS

Assigner: vmware
Reserved: 04.07.2026 Published: 27.08.2026 Updated: 27.08.2026

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Spring
Product	Spring Integration
Versions	Default: unaffected Version 7.1.0 is affected affected from 7.0.0 to 7.0.5 (incl.) affected from 6.5.0 to 6.5.10 (incl.) affected from 6.4.0 to 6.4.12 (incl.)

References

https://spring.io/security/cve-2026-59274

Problem Types

CWE-409 Improper Handling of Highly Compressed Data (Data Amplification, Decompression Bomb) CWE

Impacts

The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage.