Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-59322

EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Integration

Default version status: unaffected

  • 7.1.0affected
  • 7.0.0 to ≤ 7.0.5affected
  • 6.5.0 to ≤ 6.5.10affected
  • 6.4.0 to ≤ 6.4.12affected
  • 0 to ≤ 5.5.21affected

References