Skip to content
OpenAdvisories

Product · Spring

Spring Integration

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-59324

    fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

    When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propag…

    Spring Spring Integration
  • High 8.0
    CVE-2026-59307

    Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

    An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Sprin…

    Spring Spring Integration
  • High 7.1
    CVE-2026-40987 Public exploit

    Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization

    A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem (outside the configured local-directory) with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.…

    Spring Spring Integration org.springframework.integration:spring-integration-file Maven