Executive brief
Spring Integration's UnZipTransformer component processes ZIP archives without limiting decompressed file sizes or entry counts. An attacker can send a specially crafted ZIP archive (a "zip bomb") that expands to consume all available Java heap memory, crashing the application and causing a service outage for all users.
Technical details
The UnZipTransformer in Spring Integration lacks input validation on decompressed entry size and total entry count when extracting ZIP archives. This is a classic zip bomb or decompression bomb vulnerability (CWE-409). An attacker with network access can craft a compressed archive containing highly compressed data that expands to gigabytes or terabytes when decompressed, exhausting JVM heap memory and triggering an OutOfMemoryError. The vulnerability requires the application to be configured to use UnZipTransformer and process untrusted ZIP input, but no authentication or user interaction is needed once such a flow is active. The fix involves adding resource limits (maximum decompressed size per entry and total entry count) before decompression.
Affected products
- VMware Spring Integration 6.4.0–6.4.12, 6.5.0–6.5.10, 7.0.0–7.0.5, 7.1.0
Timeline
- 2026-08-27: disclosed