Unbounded decompression in the UnZipTransformer allows an attacker to supply a zip archive that can consume an arbitrary amount of JVM heap memory. This memory exhaustion leads to application crashes or unresponsiveness, effectively denying service to legitimate users.

The vulnerability affects Spring Integration versions 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting that widespread exploitation is not confirmed. However, any application that processes untrusted zip archives using UnZipTransformer could be exploited by sending a specially crafted archive that triggers heap exhaustion. The attack vector is likely through application input channels that accept zip files, which may be remote or local depending on the deployment. Containment requires proper version upgrades or mitigations to prevent memory exhaustion.