4 matches found
CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...
CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
When an IntegrationFlow uses .fluxTransform with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers replyChannel, errorChannel, correlationId, any propagated security/tenant headers copied from...
CVE-2026-59324
Spring Integration is vulnerable to cross-message header leakage when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering fluxFunction that emits raw payloads. The root cause is a shared RequestMessageHolder , which causes concurrent requests on the same FluxMessageChannel...
