Skip to content
fr Sign in
6.3 Medium

CVE-2026-47856 Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type,…

Description

Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Affected products and versions

Product Affected versions Fixed in
Spring Integration 7.1.0 No fix stated
Spring Integration 7.0 7.0.0 → 7.0.5 No fix stated
Spring Integration 6.5 6.5.0 → 6.5.10 No fix stated
Spring Integration 6.4 6.4.0 → 6.4.12 No fix stated
Spring Integration 5.5 earliest → 5.5.21 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Integration

The 16 CVEs of Spring Integration →
CVE-2026-59324 When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads,… 8.2 High CVE-2026-59322 The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor 6.3 Medium CVE-2026-59321 A single ScriptEngine instance is reused for every message on a script-backed channel 4.2 Medium CVE-2026-59311 A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their… 6.8 Medium
Track this CVE