CVE-2026-59322

Analyzed Analyzed - Analysis Complete

Insecure Header Parsing in Spring Integration

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59322

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_integration	From 6.4.0 (inc) to 6.4.13 (exc)
vmware	spring_integration	From 6.5.0 (inc) to 6.5.11 (exc)
vmware	spring_integration	From 7.0.0 (inc) to 7.0.5.1 (exc)
vmware	spring_integration	From 7.1.0 (inc) to 7.1.0.1 (exc)
vmware	spring_integration	to 5.5.22 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability involves the EmbeddedHeadersJsonMessageMapper in Spring Integration, which by default allows untrusted header names to be injected during JSON deserialization without proper sanitization. This can lead to arbitrary MessageHeaders entries being created, potentially including sensitive control headers.

Detection Guidance

Detecting this vulnerability requires checking for affected Spring Integration versions and inspecting message headers for suspicious entries. Use commands like 'find / -name "spring-integration*.jar" 2>/dev/null' to locate Spring Integration JAR files and verify versions. Check logs for messages containing headers like replyChannel, errorChannel, routingSlip, or json__TypeId__.

Impact Analysis

The vulnerability may allow unauthorized access or manipulation of message headers. Attackers could inject headers like replyChannel, errorChannel, or routingSlip, which might propagate into downstream components and affect message routing or processing.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access or manipulation of message headers. Sensitive control headers like replyChannel or errorChannel might be injected, which could lead to improper handling of personal or protected health information during message processing.

Mitigation Strategies

Upgrade to fixed versions of Spring Integration as specified in the CVE advisory. Apply patches provided by Spring for affected versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 or earlier.

Hi! I’m here to help you understand CVE-2026-59322. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70