Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-47880 EUVD-2026-66843GHSA-cjjj-j5gv-xhv7

DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names

Published Aug 27, 2026 · Updated Aug 27, 2026 · Assigned by vmware

Description

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier

Affected products

VendorProductAffectedFixed
Spring Spring Integration 7.1.0, 7.0.0 – ≤ 7.0.5, 6.5.0 – ≤ 6.5.10, 6.4.0 – ≤ 6.4.12, ≤ 5.5.21 —

References