CVE-2026-47880
Received Received - Intake

Spring MessageHeader Injection in Spring Integration

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-47880
EUVD
EUVD-2026-66843

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
spring integration From 7.1.0.1 (exc)
spring integration From 7.0.0 (inc) to 7.0.6 (exc)
spring integration From 6.5.0 (inc) to 6.5.11 (exc)
spring integration From 6.4.0 (inc) to 6.4.13 (exc)
spring integration to 5.5.22 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a producer to publish to a JMS destination consumed by Spring Integration JMS inbound components. They can set specific JMS properties like replyChannel, errorChannel, or json__TypeId__ which are then copied directly into Spring Integration MessageHeaders. This can redirect handler output or error messages to unintended MessageChannel beans.

Detection Guidance

Check if your Spring Integration application uses JMS inbound components and inspect JMS messages for properties named replyChannel, errorChannel, or json__TypeId__. Monitor MessageChannel beans for unexpected redirections or errors.

Impact Analysis

An attacker could exploit this to redirect application messages or errors to malicious channels, potentially leading to data leaks, unauthorized access, or disruption of normal application flow. It may allow bypassing intended security controls or message routing logic.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, which may violate GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations using affected versions must address this to maintain compliance.

Mitigation Strategies

Upgrade to fixed versions: Spring Integration 7.1.1 (OSS), 7.0.6 (OSS), 6.5.11 (Enterprise), 6.4.13 (Enterprise), or 5.5.22 (Enterprise). No additional mitigation steps are required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47880. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart