SB20260828162 - Multiple vulnerabilities in Spring Integration
Published: August 28, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 14 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-47859)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in RFC6587SyslogDeserializer when processing octet-counted RFC 6587 / RFC 5424 frames. A remote user can send a frame with an arbitrarily large declared length to cause a denial of service.
The non-transparent LF-delimited framing path is not affected.
2) Input validation error (CVE-ID: CVE-2026-47856)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information, modify data, or cause a denial of service.
The vulnerability exists due to improper input validation in JsonToObjectTransformer when processing externally supplied json__TypeId__ message headers during JSON to object conversion. A remote user can supply a crafted header value to disclose sensitive information, modify data, or cause a denial of service.
The issue occurs when the header originates from an external producer and is mapped from the inbound transport into the message.
3) Input validation error (CVE-ID: CVE-2026-47861)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause the server to send UDP datagrams to arbitrary internal or external hosts and ports.
The vulnerability exists due to improper input validation in the Spring Integration UDP inbound adapter when parsing packet bodies. A remote user can send a crafted UDP packet to cause the server to send UDP datagrams to arbitrary internal or external hosts and ports.
The attacker controls both the destination host and port, and the emitted payload is a 36-byte UUID string.
4) Path traversal (CVE-ID: CVE-2026-47862)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to write a .zip archive to an arbitrary filesystem path outside the configured workDirectory.
The vulnerability exists due to improper input validation in ZipTransformer when using the file_name message header to build the workDirectory path. A remote user can set a specially crafted file_name header on a message to write a .zip archive to an arbitrary filesystem path outside the configured workDirectory.
The issue applies when ZipTransformer is used with ZipResultType.FILE, which is the default behavior.
5) Deserialization of Untrusted Data (CVE-ID: CVE-2026-47864)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to unsafe java deserialization in SerializingHttpMessageConverter when processing inbound HTTP requests with Content-Type application/x-java-serialized-object. A remote user can send a specially crafted serialized request body to execute arbitrary code.
Exploitation requires an application to use this converter on an inbound HTTP endpoint and to have a known Java deserialization gadget on its classpath.
6) Input validation error (CVE-ID: CVE-2026-47880)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to redirect handler output or error messages and disclose sensitive information.
The vulnerability exists due to improper input validation in DefaultJmsHeaderMapper and downstream channel resolution when processing JMS messages with user-controlled properties. A remote user can set crafted JMS properties named replyChannel, errorChannel, or json__TypeId__ to redirect handler output or error messages and disclose sensitive information.
The issue affects Spring Integration JMS inbound components that consume messages from a JMS destination.
7) Protection mechanism failure (CVE-ID: CVE-2026-59307)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in JdbcMessageStore deserialization handling when deserializing data from INT_MESSAGE.MESSAGE_CONTENT. A remote privileged user can write crafted serialized bytes into INT_MESSAGE.MESSAGE_CONTENT to execute arbitrary code.
The issue occurs when the store is used as a Spring-managed bean, because setBeanClassLoader replaces the deserializing converter while the row mapper continues using a stale reference and the configured allow-list is never consulted.
8) Insecure Default Initialization of Resource (CVE-ID: CVE-2026-59293)
CWE-ID: CWE-1188 - Insecure Default Initialization of Resource
CVSSv4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to intercept or alter transferred files and capture NTLM credentials.
The vulnerability exists due to insecure default configuration in the SMB adapter jCIFS client configuration when negotiating the SMB protocol dialect. A remote privileged user can downgrade the connection to smb1/cifs in a machine-in-the-middle position to intercept or alter transferred files and capture NTLM credentials.
The issue occurs unless the application explicitly raises smbMinVersion.
9) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-59292)
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to disclose sensitive information.
The vulnerability exists due to improper access control in PropertiesPersistingMetadataStore metadata file handling when persisting metadata to a temporary file location. A local privileged user can read the world-readable metadata file to disclose sensitive information.
The issue affects the metadata store file located under a shared java.io.tmpdir path and may expose processed message keys, offsets, or idempotency markers.
10) Race condition (CVE-ID: CVE-2026-59321)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information or cause a denial of service.
The vulnerability exists due to improper concurrent access in shared JSR-223 ScriptEngine instances in script-backed channels when processing concurrent messages with engines that report THREADING=null. A remote user can trigger concurrent script evaluations to disclose sensitive information or cause a denial of service.
In multi-tenant or request/response flows, one message's payload or header bindings may leak into another message's script evaluation.
11) Link following (CVE-ID: CVE-2026-59311)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite files or disclose sensitive information.
The vulnerability exists due to improper handling of a predictable temporary directory symlink in Zip/UnZip transformers when processing archive transformation output on a host where /tmp/ziptransformer can be pre-created as a symlink. A remote user can pre-create /tmp/ziptransformer as a symlink to redirect output files and extracted contents to a directory of their choosing to overwrite files or disclose sensitive information.
The issue is exploitable only by a user on the same host, and exploitation must occur before the application starts.
12) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-59324)
CWE-ID: CWE-668 - Exposure of resource to wrong sphere
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and misroute replies.
The vulnerability exists due to improper state management in RequestMessageHolder used by fluxTransform() on FluxMessageChannel subscriptions when processing concurrent requests with an asynchronous or reordering fluxFunction that emits raw payloads. A remote attacker can send concurrent requests to disclose sensitive information and misroute replies.
The issue occurs when reply headers such as replyChannel, errorChannel, correlationId, or propagated security and tenant headers are copied from the most recently consumed upstream message.
13) Input validation error (CVE-ID: CVE-2026-59322)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject arbitrary message headers and influence message processing.
The vulnerability exists due to improper input validation in EmbeddedHeadersJsonMessageMapper when processing raw byte payloads with decodeNativeFormat. A remote user can send specially crafted data with embedded JSON headers to inject arbitrary message headers and influence message processing.
This affects deployments that use the mapper with default settings, such as ZeroMqChannel receiving raw socket bytes.
14) Resource exhaustion (CVE-ID: CVE-2026-59274)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper resource consumption in UnZipTransformer when processing zip archives. A remote user can send a specially crafted zip archive to cause a denial of service.
Remediation
Install update from vendor's website.
References
- https://spring.io/security/cve-2026-47859
- https://spring.io/security/cve-2026-47856
- https://spring.io/security/cve-2026-47861
- https://spring.io/security/cve-2026-47862
- https://spring.io/security/cve-2026-47864
- https://spring.io/security/cve-2026-47880
- https://spring.io/security/cve-2026-59307
- https://spring.io/security/cve-2026-59293
- https://spring.io/security/cve-2026-59292
- https://spring.io/security/cve-2026-59321
- https://spring.io/security/cve-2026-59311
- https://spring.io/security/cve-2026-59324
- https://spring.io/security/cve-2026-59322
- https://spring.io/security/cve-2026-59274