cbcvebase.
CVE-2026-59307
published 2026-08-27

CVE-2026-59307: An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed…

PriorityP341high8CVSS 3.1
AVNACHPRHUINSCCHIHAH
EPSS
0.42%
35.0th percentile
An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Affected

12 ranges
VendorProductVersion rangeFixed in
springspring_integration——
springspring_integration6.4.0 – 6.4.12—
springspring_integration6.5.0 – 6.5.10—
springspring_integration7.0.0 – 7.0.5—
vmwarespring_integration——
vmwarespring_integration——
vmwarespring_integration——
vmwarespring_integration——
vmwarespring_integration——
vmwarespring_integration6.4.0 – 6.4.12—
vmwarespring_integration6.5.0 – 6.5.10—
vmwarespring_integration7.0.0 – 7.0.5—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.