CVE-2026-47861

Spring Integration UDP inbound adapter contains a flaw where the adapter sends an acknowledgment (ack) to a host:port parsed from the packet body, even when acknowledge=false is configured. An unauthenticated remote attacker who can send a single UDP packet to the adapter can cause the server to ...

CVE-2026-59324

Spring Integration is vulnerable to cross-message header leakage when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering fluxFunction that emits raw payloads. The root cause is a shared RequestMessageHolder , which causes concurrent requests on the same FluxMessageChannel...

CVE-2026-40987

CVE-2026-40987 affects Spring Integration across multiple tracked branches (7.0.0–7.0.4, 6.5.0–6.5.8, 6.4.0–6.4.11, 6.3.0–6.3.14, 5.5.0–5.5.20). The connected documents describe a vulnerability where a malicious or compromised FTP/SFTP/SMB server can cause the client to write arbitrary files anyw...

CVE-2026-47864

Spring Integration 's SerializingHttpMessageConverter deserializes incoming HTTP request bodies using a raw java.io.ObjectInputStream with no class filtering. Any request with Content-Type: application/x-java-serialized-object whose body resolves to a Serializable type is processed directly via r...

CVE-2026-47859

CVE-2026-47859 affects Spring Integration 's RFC6587SyslogDeserializer , the component used by the syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames. The root cause is that the deserializer trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array o...

CVE-2026-47856

Spring Integration 's JsonToObjectTransformer deserializes JSON messages by resolving the json__TypeId__ message header to a target class via ClassUtils.forName, with no type or package allow-list to constrain the resolved class. This allows an attacker with low privileges to supply an arbitrary ...

CVE-2026-47880

CVE-2026-47880 affects Spring Integration (5.5.21 and earlier, 6.4.0–6.4.12, 6.5.0–6.5.10, 7.0.0–7.0.5, and 7.1.0). The root cause is that DefaultJmsHeaderMapper copies all JMS user properties into Spring Integration MessageHeaders without excluding framework-significant names. A JMS producer can...

CVE-2026-59292

CVE-2026-59292 affects Spring Integration , where the default file-based PropertiesPersistingMetadataStore persists its state to ${java.io.tmpdir}/spring-integration/metadata-store.properties with world-readable permissions , allowing local users with high privileges to read metadata. The CVSS 3....

CVE-2026-59322

Spring Integration 's EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header-parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders...