6.3
Moyenne
CVE-2026-59322 The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor
Description
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Spring Integration | 7.1.0 | Pas de correctif indiqué |
| Spring Integration 7.0 | 7.0.0 → 7.0.5 | Pas de correctif indiqué |
| Spring Integration 6.5 | 6.5.0 → 6.5.10 | Pas de correctif indiqué |
| Spring Integration 6.4 | 6.4.0 → 6.4.12 | Pas de correctif indiqué |
| Spring Integration 5.5 | premières → 5.5.21 | Pas de correctif indiqué |
Références
- spring.io spring.io
Chronologie
- Publiée
- Dernière modification
Autres CVE de Spring Integration
Les 16 CVE de Spring Integration →
CVE-2026-59324
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads,…
8.2
Élevée
CVE-2026-59321
A single ScriptEngine instance is reused for every message on a script-backed channel
4.2
Moyenne
CVE-2026-59311
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their…
6.8
Moyenne
CVE-2026-59307
An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all…
8.0
Élevée