Spring Integration vulnerabilities

CVE-2026-47864 [CRITICAL] CWE-502 CVE-2026-47864: SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.O SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpo

CVE-2019-3772 [CRITICAL] CWE-611 CVE-2019-3772: Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0. Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

CVE-2026-47861 [MEDIUM] CWE-918 CVE-2026-47861: An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbo An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integra

CVE-2026-59324 [HIGH] CWE-362 CVE-2026-59324: When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emit When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstrea

CVE-2026-59307 [HIGH] CWE-502 CVE-2026-59307: An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVE-2026-40987 [HIGH] CWE-22 CVE-2026-40987: A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client file A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through 6.3.14; 5.5.0 through 5.5.20.

CVE-2026-59311 [MEDIUM] CWE-59 CVE-2026-59311: A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a dire A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVE-2026-47856 [MEDIUM] CWE-502 CVE-2026-47856: Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserial Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring

CVE-2026-59322 [MEDIUM] CWE-20 CVE-2026-59322: The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring

CVE-2026-59293 [MEDIUM] CWE-757 CVE-2026-59293: Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1 Unless the application explicitly raises smbMinVersion, the jCIFS client will negotiate down to SMB1/CIFS, which lacks mandatory signing/encryption and is vulnerable to NTLM relay and content-tampering MITM. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVE-2026-59274 [MEDIUM] CWE-409 CVE-2026-59274: The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVE-2026-47859 [MEDIUM] CWE-770 CVE-2026-47859: RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6 RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Sp

CVE-2026-47862 [MEDIUM] CWE-22 CVE-2026-47862: An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultTy An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integratio

CVE-2026-47880 [MEDIUM] CWE-20 CVE-2026-47880: A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound compo A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spr

CVE-2026-59321 [MEDIUM] CWE-362 CVE-2026-59321: A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 e A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers bindings into another message's script evaluation or th

CVE-2026-59292 [LOW] CWE-732 CVE-2026-59292: PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its stat PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 a