CVE-2026-59274: Unbounded decompression in UnZipTransformer enables zip-bomb DoS
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using Spring Integration versions 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, or 6.4.0 through 6.4.12 are affected when they process attacker-supplied ZIP archives through the UnZipTransformer.
What does an attacker need to exploit it?
An attacker needs the ability to send a crafted ZIP archive to a processing path that uses the UnZipTransformer. No user interaction is required, but the CVSS vector indicates low privileges are required.
What is the operational impact?
A ZIP bomb can cause unbounded decompression, exhausting JVM heap memory and producing a denial-of-service outage. The provided severity data indicates availability impact only, with no confidentiality or integrity impact.
What can be done if an update cannot be applied immediately?
Limit or prevent untrusted ZIP archives from reaching the UnZipTransformer, and apply external controls that restrict archive size and entry count before processing. Monitor JVM heap usage and archive-processing paths for memory exhaustion symptoms.