Input validation error in Spring Integration - CVE-2026-59322
Published: August 28, 2026
Vulnerability identifier: #VU146214
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59322
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject arbitrary message headers and influence message processing.
The vulnerability exists due to improper input validation in EmbeddedHeadersJsonMessageMapper when processing raw byte payloads with decodeNativeFormat. A remote user can send specially crafted data with embedded JSON headers to inject arbitrary message headers and influence message processing.
This affects deployments that use the mapper with default settings, such as ZeroMqChannel receiving raw socket bytes.
Affected software
Spring Integration
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-59322
Install security update from vendor's website.
Spring Integration - addressed in versions 5.5.22, 6.4.13, 6.5.11, 7.0.5.1, 7.0.6, 7.1.0.1, 7.1.1
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19