Spring Integration.

fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

• Spring Integration
• Race condition

EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

• Spring Integration
• CWE-20

Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

• Spring Integration
• Race condition

Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

• Spring Integration
• Path traversal

Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

• Spring Integration
• Insecure deserialization

SMB minimum protocol dialect defaults to SMB1

• Spring Integration
• CWE-757

World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)

• Spring Integration
• Broken access control

Unbounded decompression in UnZipTransformer enables zip-bomb DoS

• Spring Integration
• CWE-409

DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

• Spring Integration
• CWE-20

Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

• Spring Integration
• Insecure deserialization

UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false

• Spring Integration
• Server-side request forgery (SSRF)

ZipTransformer uses file_name header to build workDirectory path without sanitization

• Spring Integration
• Path traversal

Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS

• Spring Integration
• Denial of service

JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

• Spring Integration
• Insecure deserialization