CVE-2026-59322

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-59322

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59322.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-59322

Published

2026-08-27T18:04:50Z

Modified

2026-09-03T03:48:20Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator

Summary

EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

Details

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Database specific

{
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59322.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.1.0"
                },
                {
                    "last_affected": "7.1.0"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.0.5"
                },
                {
                    "introduced": "6.5.0"
                },
                {
                    "last_affected": "6.5.10"
                },
                {
                    "introduced": "6.4.0"
                },
                {
                    "last_affected": "6.4.12"
                },
                {
                    "last_affected": "5.5.21"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/spring-projects/spring-integration

Affected ranges

Type

GIT

Repo

https://github.com/spring-projects/spring-integration

Events

Introduced

79963f89e3cab04addfe32aa4b419e5ffb73e909

Fixed

ae4c9bb8eff504f26b67cc6ac65fed2c8fb8382e

Database specific

Show details

{
    "cpe": "cpe:2.3:a:vmware:spring_integration:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.1.0"
        },
        {
            "fixed": "7.1.0.1"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59322.json"