CVE-2026-59322

Spring Integration 's EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header-parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders...

CVE-2026-59322 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

EUVD-2026-67203

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

CVE-2026-59322 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

CVE-2026-59322 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

EUVD-2026-67202

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

CVE-2026-59321

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null not thread-safe, e.g. the Kotlin kts engine, concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers...

CVE-2026-59321

Spring Integration versions 7.1.0 , 7.0.0–7.0.5 , 6.5.0–6.5.10 , 6.4.0–6.4.12 , and 5.5.21 and earlier are affected by a thread-safety flaw in script-backed channels. A single JSR-223 ScriptEngine instance is shared across all messages without verifying the engine's THREADING capability. When a n...

CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-59311

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

EUVD-2026-67195

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

CVE-2026-59311

Spring Integration is vulnerable to a symlink pre-creation attack on its predictable /tmp/ziptransformer work directory. A local unprivileged user on the same host can pre-create that path as a symlink before the application starts, redirecting all Zip/Unzip transformer output into a directory of...

CVE-2026-59307

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59307

Spring Integration JdbcMessageStore has a deserialization allow-list bypass. When the store is a Spring-managed bean , calling addAllowedPatterns(...) to restrict deserialization is silently ineffective because setBeanClassLoader (invoked during Spring's bean lifecycle) replaces the deserializer ...