CVE-2026-59307

Received Received - Intake

Deserialization Flaw in Spring Integration

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description

An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-59307

Affected Vendors & Products

Vendor	Product	Version / Range
spring	spring_integration	7.1.0
spring	spring_integration	From 7.0.0 (inc) to 7.0.6 (exc)
spring	spring_integration	From 6.5.0 (inc) to 6.5.11 (exc)
spring	spring_integration	From 6.4.0 (inc) to 6.4.13 (exc)
spring	integration	7.1.0
spring	integration	From 7.0.0 (inc) to 7.0.5 (inc)
spring	integration	From 6.5.0 (inc) to 6.5.10 (inc)
spring	integration	From 6.4.0 (inc) to 6.4.12 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

CVE-2026-59307 is a deserialization allow-list bypass in Spring Integration. When an operator uses JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization, the protection fails if the store is a Spring-managed bean. The container's setBeanClassLoader method replaces the deserializing converter with a permit-all instance, but the row mapper still uses the original converter. This allows attackers to bypass the allow-list and achieve remote code execution.

Impact Analysis

If you use affected Spring Integration versions, an attacker who can write to INT_MESSAGE.MESSAGE_CONTENT may execute arbitrary code on your system. This could lead to full system compromise, data theft, or service disruption. The impact is high severity with a CVSS score of 8.0.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially exposing sensitive data. This may violate GDPR's data protection requirements or HIPAA's security rules, depending on the data processed. Compliance could be compromised if the breach results in unauthorized access to personal or health data.

Mitigation Strategies

Upgrade to fixed versions: Spring Integration 7.1.1 (OSS), 7.0.6 (OSS), 6.5.11, or 6.4.13. Enterprise fixes are available for 7.1.0.1, 7.0.5.1, and 6.4.13.

Hi! I’m here to help you understand CVE-2026-59307. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70