8.0
High
CVE-2026-59307 An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all…
Description
An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Integration | 7.1.0 | No fix stated |
| Spring Integration 7.0 | 7.0.0 → 7.0.5 | No fix stated |
| Spring Integration 6.5 | 6.5.0 → 6.5.10 | No fix stated |
| Spring Integration 6.4 | 6.4.0 → 6.4.12 | No fix stated |
References
- spring.io spring.io
Timeline
- Published
- Last modified
Other CVEs of Spring Integration
The 16 CVEs of Spring Integration →
CVE-2026-59324
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads,…
8.2
High
CVE-2026-59322
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor
6.3
Medium
CVE-2026-59321
A single ScriptEngine instance is reused for every message on a script-backed channel
4.2
Medium
CVE-2026-59311
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their…
6.8
Medium