Vulnerability · Published Aug 27, 2026 · Assigned by vmware

CVE-2026-47864Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

Medium 6.4

In plain English

A medium-severity unsafe deserialization in Spring Integration from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.9% (higher than 93% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)5.9%top 6.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Affected products (as reported)

Vendor	Product	Versions
Spring	Spring Integration	7.1.07.0.0 – through 7.0.56.5.0 – through 6.5.106.4.0 – through 6.4.120 – through 5.5.21

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

References

https://spring.io/security/cve-2026-47864