CVE-2026-59274: Spring Integration UnZipTransformer DoS

CVE-2026-59274 Overview

CVE-2026-59274 is a denial-of-service vulnerability in the Spring Integration UnZipTransformer component. The transformer does not enforce limits on decompressed entry size or entry count when processing zip archives. An attacker with authenticated access can submit a crafted zip archive that exhausts Java Virtual Machine (JVM) heap memory. The condition is a classic decompression bomb pattern that leads to resource exhaustion and application outage.

Critical Impact
A remote authenticated attacker can send a malicious zip archive to trigger heap exhaustion, causing full denial of service to the Spring Integration application.

Affected Products

Spring Integration 7.1.0
Spring Integration 7.0.0 through 7.0.5
Spring Integration 6.5.0 through 6.5.10
Spring Integration 6.4.0 through 6.4.12

Discovery Timeline

2026-08-27 - CVE-2026-59274 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-59274

Vulnerability Analysis

Spring Integration provides the UnZipTransformer class to decompress zip archives inside messaging flows. The transformer streams entries from the archive and materializes their contents in memory or writes them to disk. The implementation does not cap the total decompressed size, the size of any single entry, or the number of entries processed. An attacker who can deliver a message to a flow containing this transformer can send a small archive that expands to gigabytes in memory.

The result is heap memory exhaustion within the JVM hosting the application. Once the heap is saturated, garbage collection stalls the application and OutOfMemoryError conditions terminate request handling. Confidentiality and integrity are not affected, but availability drops to zero until the process restarts.

Root Cause

The root cause is missing input validation on archive metadata and streamed content [CWE-409 Uncontrolled Resource Consumption]. UnZipTransformer trusts the compressed archive and does not enforce a maximum decompressed byte count, entry count, or compression ratio ceiling before consuming entries.

Attack Vector

Exploitation requires network access and low-privilege authentication to reach a Spring Integration flow that routes messages through UnZipTransformer. The attacker crafts a zip archive with either many entries or highly compressible content such as long runs of zero bytes. When the transformer decompresses the payload, JVM heap usage grows until the process fails. See the Spring Security Advisory for CVE-2026-59274 for vendor details.

Detection Methods for CVE-2026-59274

Indicators of Compromise

Repeated java.lang.OutOfMemoryError: Java heap space entries in application logs correlated with zip processing.
Sudden JVM heap growth and long garbage collection pauses during message ingestion by flows using UnZipTransformer.
Inbound messages containing zip payloads with extreme compression ratios or very high entry counts.

Detection Strategies

Inspect message payload metadata for zip archives whose uncompressed size is disproportionate to their compressed size.
Alert on Spring Integration components emitting UnZipTransformer stack traces or heap-related errors.
Correlate authentication events with subsequent memory pressure spikes to identify abusive clients.

Monitoring Recommendations

Enable JVM heap and garbage collection telemetry through Java Management Extensions (JMX) or Micrometer for all Spring Integration workloads.
Track per-endpoint message throughput and payload size distributions to baseline normal archive traffic.
Forward application logs to a central analytics platform and alert on OutOfMemoryError and Spring Integration transformer exceptions.

How to Mitigate CVE-2026-59274

Immediate Actions Required

Upgrade Spring Integration to a patched maintenance release in the 6.4.x, 6.5.x, 7.0.x, or 7.1.x branch as published in the Spring advisory.
Restrict access to messaging endpoints that invoke UnZipTransformer so only trusted, authenticated producers can submit archives.
Apply upstream size limits on zip payloads at ingress components such as HTTP gateways or message brokers.

Patch Information

Refer to the Spring Security Advisory for CVE-2026-59274 for the corrected maintenance versions across the 6.4, 6.5, 7.0, and 7.1 lines. Update project dependencies through Maven or Gradle and redeploy affected services.

Workarounds

Replace UnZipTransformer with a custom transformer that enforces maximum entry count, maximum uncompressed entry size, and total decompressed byte budgets before writing output.
Cap JVM heap and enable container-level memory limits so a single flow cannot consume all node memory.
Reject inbound zip payloads whose declared uncompressed size or entry count exceeds business requirements before they reach the transformer.

bash

# Example Maven dependency pin to a patched Spring Integration release
mvn versions:set-property \
  -Dproperty=spring-integration.version \
  -DnewVersion=6.5.11

# Verify effective version in the resolved dependency tree
mvn dependency:tree | grep spring-integration-core