Spring Integration
Monthly
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Unsafe header deserialization in Spring Integration's EmbeddedHeadersJsonMessageMapper exposes applications to header injection across all active release trains (5.5.x through 7.1.0). The decodeNativeFormat method constructs GenericMessage objects with MutableMessageHeaders populated directly from attacker-controlled JSON-deserialized header maps, bypassing sanitization by default in the constructor. Low-privileged network attackers who can submit crafted byte payloads to an affected consumer channel can manipulate message headers, yielding partial confidentiality, integrity, and availability impacts. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV.
Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.
Symlink redirection in Spring Integration's Zip/UnZip transformer allows a local unprivileged user sharing the same host to hijack transformer output by pre-creating /tmp/ziptransformer as a symlink before application startup. Affected versions span the 6.4, 6.5, 7.0, and 7.1 release lines, covering a wide range of enterprise Java deployments that use Spring Integration's file transformation capabilities. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the integrity and availability impact is rated High by the vendor-assigned CVSS score.
JdbcMessageStore deserialization allowlist protection in Spring Integration silently fails when the store is configured as a Spring-managed bean, rendering the security control entirely ineffective. Operators who call addAllowedPatterns() to restrict which Java classes can be deserialized from the JDBC message store receive no actual protection - any class remains deserializable despite the configured allowlist - leaving applications exposed to unsafe Java deserialization attacks while operators believe they have hardened the component. Affected across Spring Integration 6.4.x through 7.1.0; no public exploit identified at time of analysis.
Spring Integration's jCIFS-based SMB client silently negotiates down to legacy SMB1/CIFS when applications omit an explicit `smbMinVersion` setting, exposing file transfer sessions to NTLM relay attacks and in-transit content tampering by a network-positioned adversary. Affected versions span Spring Integration 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and the standalone release 7.1.0 - covering all currently active Spring Integration release trains at time of disclosure. No CISA KEV listing or public exploit code specific to this CVE has been identified at time of analysis, though NTLM relay is a mature, extensively tooled attack class; EPSS data was not available in the sourced intelligence.
Spring Integration's default file-based metadata store writes persistent state to a world-readable file under java.io.tmpdir, exposing integration metadata to any local OS user on the affected host. All actively maintained branches are affected, spanning versions 5.5.21 and earlier through 7.1.0. No public exploit code or active exploitation has been identified at time of analysis; practical impact is limited to local confidentiality disclosure on shared or multi-user systems.
Spring Integration's UnZipTransformer component fails to impose any limit on decompressed entry size or entry count, enabling a low-privileged remote attacker to trigger JVM heap exhaustion via a crafted zip bomb archive. Affected versions span 6.4.0-6.4.12, 6.5.0-6.5.10, and 7.0.0-7.1.0 across the widely-used Spring enterprise Java framework. The attack primitive is well-understood and trivially constructable, though exploitation requires access to an integration endpoint that routes payloads through UnZipTransformer; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Remote code execution in Spring Integration allows a remote, unauthenticated attacker to run arbitrary code on applications that expose the SerializingHttpMessageConverter on an inbound HTTP endpoint. The converter reads any request body sent with Content-Type application/x-java-serialized-object through a raw java.io.ObjectInputStream.readObject() with no allow-list or class filtering, so if any known Java deserialization gadget is present on the application classpath it can be chained to code execution. No public exploit is identified at time of analysis, but EPSS places it in the 88th percentile (3.44%) and the vulnerability class is well-understood, making it a high-priority patch for exposed deployments.
Spring Integration's UDP inbound adapter can be abused by unauthenticated remote attackers to coerce the server into emitting outbound UDP datagrams to arbitrary hosts and ports - a classic UDP Server-Side Request Forgery (SSRF). Affected versions span the entire supported line from 5.5.x through 7.1.0, covering a wide range of enterprise Java deployments. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (single crafted UDP packet) makes this straightforward to weaponize once the adapter port is located.
Path traversal in Spring Integration's ZipTransformer allows a low-privileged attacker who controls the file_name message header to write ZIP archive output to arbitrary filesystem paths outside the configured workDirectory. Affected versions span the 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines of Spring Integration, and exploitation is viable by default since ZipResultType.FILE is the standard configuration. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Uncontrolled memory allocation in Spring Integration's RFC6587SyslogDeserializer allows any network-reachable, low-privileged syslog sender to supply an arbitrarily large octet count, causing the TCP inbound adapter to allocate an unbounded byte array and potentially read across RFC 6587 message frame boundaries. Affected release lines span 5.5.x through 7.1.0. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low attack complexity and low privilege requirement make exploitation straightforward for any entity permitted to deliver syslog messages to the adapter.
Unsafe deserialization in Spring Integration exposes network-accessible, low-privilege attackers to arbitrary Java class instantiation by manipulating the json__TypeId__ message header, which is resolved via ClassUtils.forName without any type or package allowlist. All maintained Spring Integration branches are affected - 5.5.21 and earlier, 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and 7.1.0 - making the exposure broad across the Spring ecosystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the deserialization-via-header-controlled-type pattern is a well-understood Java attack class with a mature exploit toolkit.
Path traversal in Spring Integration's FTP/SFTP/SMB inbound adapters allows a malicious or compromised remote file server to write attacker-controlled files outside the configured local directory on any client polling it, affecting versions 5.5.0-5.5.20, 6.3.0-6.3.14, 6.4.0-6.4.11, 6.5.0-6.5.8, and 7.0.0-7.0.4. The flaw inverts the usual trust model - the file-transfer client trusts the server's filename, enabling overwrite of arbitrary host files such as configuration, cron, or application JARs, which can escalate to code execution. No public exploit identified at time of analysis, but the issue is straightforward to weaponize once a hostile server endpoint is reachable.
Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Unsafe header deserialization in Spring Integration's EmbeddedHeadersJsonMessageMapper exposes applications to header injection across all active release trains (5.5.x through 7.1.0). The decodeNativeFormat method constructs GenericMessage objects with MutableMessageHeaders populated directly from attacker-controlled JSON-deserialized header maps, bypassing sanitization by default in the constructor. Low-privileged network attackers who can submit crafted byte payloads to an affected consumer channel can manipulate message headers, yielding partial confidentiality, integrity, and availability impacts. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV.
Concurrent message processing in Spring Integration's script-backed channels causes shared ScriptEngine state corruption when using JSR-223 engines that declare THREADING=null, such as the Kotlin KTS engine. Affected Spring Integration versions from 5.5.21 and earlier through 7.1.0 are susceptible to cross-message data leakage, where one message's payload or header bindings can bleed into another message's script evaluation context under concurrent load. No public exploit has been identified at time of analysis, and the CVSS 4.2 Medium rating reflects the high attack complexity imposed by the required race condition, though the information disclosure and partial integrity impact are real concerns in multi-tenant or high-throughput deployments.
Symlink redirection in Spring Integration's Zip/UnZip transformer allows a local unprivileged user sharing the same host to hijack transformer output by pre-creating /tmp/ziptransformer as a symlink before application startup. Affected versions span the 6.4, 6.5, 7.0, and 7.1 release lines, covering a wide range of enterprise Java deployments that use Spring Integration's file transformation capabilities. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, though the integrity and availability impact is rated High by the vendor-assigned CVSS score.
JdbcMessageStore deserialization allowlist protection in Spring Integration silently fails when the store is configured as a Spring-managed bean, rendering the security control entirely ineffective. Operators who call addAllowedPatterns() to restrict which Java classes can be deserialized from the JDBC message store receive no actual protection - any class remains deserializable despite the configured allowlist - leaving applications exposed to unsafe Java deserialization attacks while operators believe they have hardened the component. Affected across Spring Integration 6.4.x through 7.1.0; no public exploit identified at time of analysis.
Spring Integration's jCIFS-based SMB client silently negotiates down to legacy SMB1/CIFS when applications omit an explicit `smbMinVersion` setting, exposing file transfer sessions to NTLM relay attacks and in-transit content tampering by a network-positioned adversary. Affected versions span Spring Integration 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and the standalone release 7.1.0 - covering all currently active Spring Integration release trains at time of disclosure. No CISA KEV listing or public exploit code specific to this CVE has been identified at time of analysis, though NTLM relay is a mature, extensively tooled attack class; EPSS data was not available in the sourced intelligence.
Spring Integration's default file-based metadata store writes persistent state to a world-readable file under java.io.tmpdir, exposing integration metadata to any local OS user on the affected host. All actively maintained branches are affected, spanning versions 5.5.21 and earlier through 7.1.0. No public exploit code or active exploitation has been identified at time of analysis; practical impact is limited to local confidentiality disclosure on shared or multi-user systems.
Spring Integration's UnZipTransformer component fails to impose any limit on decompressed entry size or entry count, enabling a low-privileged remote attacker to trigger JVM heap exhaustion via a crafted zip bomb archive. Affected versions span 6.4.0-6.4.12, 6.5.0-6.5.10, and 7.0.0-7.1.0 across the widely-used Spring enterprise Java framework. The attack primitive is well-understood and trivially constructable, though exploitation requires access to an integration endpoint that routes payloads through UnZipTransformer; no public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Remote code execution in Spring Integration allows a remote, unauthenticated attacker to run arbitrary code on applications that expose the SerializingHttpMessageConverter on an inbound HTTP endpoint. The converter reads any request body sent with Content-Type application/x-java-serialized-object through a raw java.io.ObjectInputStream.readObject() with no allow-list or class filtering, so if any known Java deserialization gadget is present on the application classpath it can be chained to code execution. No public exploit is identified at time of analysis, but EPSS places it in the 88th percentile (3.44%) and the vulnerability class is well-understood, making it a high-priority patch for exposed deployments.
Spring Integration's UDP inbound adapter can be abused by unauthenticated remote attackers to coerce the server into emitting outbound UDP datagrams to arbitrary hosts and ports - a classic UDP Server-Side Request Forgery (SSRF). Affected versions span the entire supported line from 5.5.x through 7.1.0, covering a wide range of enterprise Java deployments. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity (single crafted UDP packet) makes this straightforward to weaponize once the adapter port is located.
Path traversal in Spring Integration's ZipTransformer allows a low-privileged attacker who controls the file_name message header to write ZIP archive output to arbitrary filesystem paths outside the configured workDirectory. Affected versions span the 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines of Spring Integration, and exploitation is viable by default since ZipResultType.FILE is the standard configuration. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Uncontrolled memory allocation in Spring Integration's RFC6587SyslogDeserializer allows any network-reachable, low-privileged syslog sender to supply an arbitrarily large octet count, causing the TCP inbound adapter to allocate an unbounded byte array and potentially read across RFC 6587 message frame boundaries. Affected release lines span 5.5.x through 7.1.0. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low attack complexity and low privilege requirement make exploitation straightforward for any entity permitted to deliver syslog messages to the adapter.
Unsafe deserialization in Spring Integration exposes network-accessible, low-privilege attackers to arbitrary Java class instantiation by manipulating the json__TypeId__ message header, which is resolved via ClassUtils.forName without any type or package allowlist. All maintained Spring Integration branches are affected - 5.5.21 and earlier, 6.4.0-6.4.12, 6.5.0-6.5.10, 7.0.0-7.0.5, and 7.1.0 - making the exposure broad across the Spring ecosystem. No public exploit code or CISA KEV listing has been identified at time of analysis, though the deserialization-via-header-controlled-type pattern is a well-understood Java attack class with a mature exploit toolkit.
Path traversal in Spring Integration's FTP/SFTP/SMB inbound adapters allows a malicious or compromised remote file server to write attacker-controlled files outside the configured local directory on any client polling it, affecting versions 5.5.0-5.5.20, 6.3.0-6.3.14, 6.4.0-6.4.11, 6.5.0-6.5.8, and 7.0.0-7.0.4. The flaw inverts the usual trust model - the file-transfer client trusts the server's filename, enabling overwrite of arbitrary host files such as configuration, cron, or application JARs, which can escalate to code execution. No public exploit identified at time of analysis, but the issue is straightforward to weaponize once a hostile server endpoint is reachable.
Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.
Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.