Spring Integration CVE-2026-59322

Exploitation requires the target application to explicitly configure EmbeddedHeadersJsonMessageMapper and invoke decodeNativeFormat on incoming byte payloads - this is not a default Spring Integration behavior but one specifically enabled for native-format embedded-header transport, typically used with byte-oriented message brokers like Apache Kafka. The attacker must hold at minimum PR:L access: sufficient credentials or broker permissions to act as a message producer and submit crafted payloads to the channel or topic being consumed. Limiting factors: (1) the EmbeddedHeadersJsonMessageMapper must be explicitly configured and decodeNativeFormat invoked - default Spring Integration deployments not using this mapper are unaffected; (2) the CVSS scope is unchanged (S:U), so impact is confined to the message-processing component itself; (3) CIA impacts are each Low, meaning successful exploitation achieves partial header manipulation rather than full system compromise.

The CVSS 6.3 Medium rating (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) accurately reflects a moderate priority: network-reachable, low complexity, but requiring at least low-privileged producer access and producing only partial impacts with no scope change. No EPSS score is available in the provided data, so exploitation probability cannot be quantified; the vulnerability is not listed in CISA KEV and no POC has been identified, limiting urgency signals to the CVSS vector alone. The PR:L requirement is the key limiting factor - an attacker must already hold sufficient credentials or access to inject messages into the target broker topic or channel, ruling out anonymous opportunistic exploitation. Real-world risk is highest in environments where external or partially-trusted systems act as message producers against Spring Integration consumers configured in native-format mode; the impact is bounded to header-level manipulation within the affected processing component (S:U). CVSS vector and description are consistent - no conflicting signals identified.

An attacker with low-privileged producer access to a message broker topic (e.g., Kafka or RabbitMQ) consumed by a Spring Integration application crafts a raw byte payload embedding malicious JSON headers using the native embedded-headers format. When the consumer's EmbeddedHeadersJsonMessageMapper processes the payload, decodeNativeFormat deserializes the attacker-supplied headers into MutableMessageHeaders without sanitization, allowing injection of arbitrary header names and values into the resulting GenericMessage and its downstream processing pipeline. No public exploit code has been identified at time of analysis.