Unsafe Deserialization in Spring Integration

Executive Summary

CVE-2026-47856 is a vulnerability in Spring Integration's JSON to object conversion where the system uses the json__TypeId__ header to select the class for deserializing JSON payloads without an allow-list. This allows attackers who control the header to force the system to load and deserialize into arbitrary classes.

Useful 0 Not Useful 0

Detection Guidance

Check for Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, or 5.5.21 and earlier. Inspect logs for deserialization attempts using the json__TypeId__ header. Look for unexpected class loading or serialization errors in application logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary code or access sensitive data by manipulating the json__TypeId__ header. This could lead to remote code execution, data breaches, or denial of service if the system processes untrusted messages from sources like AMQP or Kafka.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to fixed versions: 7.1.1, 7.0.6, 6.5.11, 6.4.13, or 5.5.22. If upgrading is not possible, restrict access to message channels handling JSON payloads. Implement allow-lists for deserialization targets. Monitor for suspicious class loading activities.

Useful 0 Not Useful 0