Exposure of Resource to Wrong Sphere in Spring Integration - CVE-2026-59324
Published: August 28, 2026
Vulnerability identifier: #VU146213
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59324
CWE-ID: CWE-668
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and misroute replies.
The vulnerability exists due to improper state management in RequestMessageHolder used by fluxTransform() on FluxMessageChannel subscriptions when processing concurrent requests with an asynchronous or reordering fluxFunction that emits raw payloads. A remote attacker can send concurrent requests to disclose sensitive information and misroute replies.
The issue occurs when reply headers such as replyChannel, errorChannel, correlationId, or propagated security and tenant headers are copied from the most recently consumed upstream message.
Affected software
Spring Integration
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-59324
Install security update from vendor's website.
Spring Integration - addressed in versions 5.5.22, 6.4.13, 6.5.11, 7.0.5.1, 7.0.6, 7.1.0.1, 7.1.1
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19