CVE-2026-47864
published 2026-08-27CVE-2026-47864: SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with…
PriorityP277critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.08%
90.1th percentile
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_integration | <= 5.5.21 | — |
| spring | spring_integration | — | — |
| spring | spring_integration | 6.4.0 – 6.4.12 | — |
| spring | spring_integration | 6.5.0 – 6.5.10 | — |
| spring | spring_integration | 7.0.0 – 7.0.5 | — |
| vmware | spring_integration | < 5.5.22 | 5.5.22 |
| vmware | spring_integration | >= 6.4.0 < 6.4.13 | 6.4.13 |
| vmware | spring_integration | >= 6.5.0 < 6.5.11 | 6.5.11 |
| vmware | spring_integration | >= 7.0.0 < 7.0.5.1 | 7.0.5.1 |
| vmware | spring_integration | >= 7.1.0 < 7.1.0.1 | 7.1.0.1 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering.
ghsa_unreviewed·2026-08-27
CVE-2026-47864 [MEDIUM] CWE-502 SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering.
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier
Red Hat
org.springframework.integration/spring-integration-http: Spring Integration: Arbitrary code execution via unsafe Java deserialization
vendor_redhat·2026-08-27·CVSS 9.8
CVE-2026-47864 [CRITICAL] CWE-502 org.springframework.integration/spring-integration-http: Spring Integration: Arbitrary code execution via unsafe Java deserialization
org.springframework.integration/spring-integration-http: Spring Integration: Arbitrary code execution via unsafe Java deserialization
A flaw was found in Spring Integration. The SerializingHttpMessageConverter component deserializes incoming HTTP request bodies without proper class filtering. A remote, unauthenticated attacker can exploit this by sending a specially crafted HTTP request. If a known Java deserialization 'gadget' is present on the application's classpath, this can lead to arbitrary code execution.
Statement: An unsafe Java deserialization vulnerability exists in Spring Integration's SerializingHttpMessageConverter. When processing HTTP requests with Content-Type application/x-java-serialized-object, the converter invokes ObjectInputStream.readObject() on the request body w
No detection rules found.
No public exploits indexed.
2026-08-27
Published