Skip to content
OpenAdvisories
High · 8.2 CVE-2026-59324 EUVD-2026-67204GHSA-37gx-w2pf-9hpp

fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

Published Aug 27, 2026 · Updated Aug 28, 2026 · Assigned by vmware

Description

When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier

Affected products

VendorProductAffectedFixed
Spring Spring Integration 7.1.0, 7.0.0 – ≤ 7.0.5, 6.5.0 – ≤ 6.5.10, 6.4.0 – ≤ 6.4.12, ≤ 5.5.21 —

References