Vulnerability · Published Aug 27, 2026 · Assigned by vmware

CVE-2026-59322EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

Medium 6.3

In plain English

A medium-severity improper input validation in Spring Integration from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 78.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Affected products (as reported)

Vendor	Product	Versions
Spring	Spring Integration	7.1.07.0.0 – through 7.0.56.5.0 – through 6.5.106.4.0 – through 6.4.120 – through 5.5.21

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://spring.io/security/cve-2026-59322