CVE-2026-47856: Spring Integration unsafe JSON deserialization via TypeId header

CVE-2026-47856 · Severity: medium · CVSS 6.3 · Published 2026-08-27

Spring Integration, a middleware framework used to integrate applications and services, contains a vulnerability in its JSON message processing. An attacker can craft a malicious JSON message with a specially crafted TypeId header to force the application to deserialize and instantiate arbitrary classes, potentially leading to code execution or other system compromise.

Quick answers

Is CVE-2026-47856 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47856 being exploited in the wild.
How severe is CVE-2026-47856?
Medium severity, with a CVSS score of 6.3, published 27 August 2026.
Which products and versions are affected?
Pivotal Software Spring Integration 5.5.21 and earlier, 6.4.0–6.4.12, 6.5.0–6.5.10, 7.0.0–7.0.5, 7.1.0.
Is there a fix for CVE-2026-47856?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47856 attacked?
It is attacked over the network.
Am I affected by CVE-2026-47856?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Spring Integration's JSON-to-object conversion mechanism uses the json__TypeId__ HTTP header to determine which class to deserialize JSON data into. The vulnerable code resolves this header value to a Java class using ClassUtils.forName without any allow-list or type validation. An attacker with network access to a Spring Integration endpoint can send a crafted JSON request with a malicious TypeId header pointing to a dangerous class on the classpath, achieving arbitrary deserialization and potentially remote code execution. The vulnerability affects Spring Integration versions 5.5.21 and earlier, 6.4.0–6.4.12, 6.5.0–6.5.10, and 7.0.0–7.0.5, with version 7.1.0 also affected.

Affected products

  • Pivotal Software Spring Integration 5.5.21 and earlier, 6.4.0–6.4.12, 6.5.0–6.5.10, 7.0.0–7.0.5, 7.1.0

Timeline

  • 2026-08-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.