Executive brief
Spring Integration's SerializingHttpMessageConverter accepts HTTP requests with serialized Java objects and deserializes them without any validation. An attacker can send a malicious serialized object to any Spring Integration application that exposes an HTTP endpoint using this converter, achieving arbitrary code execution if certain Java libraries are present on the application's classpath. This could lead to complete compromise of the affected application and any systems it can reach.
Technical details
The vulnerability is a Java deserialization flaw in SerializingHttpMessageConverter, which processes incoming HTTP requests with Content-Type application/x-java-serialized-object by directly calling readObject() on a raw ObjectInputStream without any gadget filtering or class validation. The vulnerability affects multiple versions: Spring Integration 7.1.0, 7.0.0–7.0.5, 6.5.0–6.5.10, 6.4.0–6.4.12, and 5.5.21 and earlier. Remote unauthenticated attackers can exploit this by sending a crafted serialized Java object in an HTTP request body; successful exploitation requires the presence of a deserialization gadget chain (such as from Apache Commons Collections or similar libraries) on the application's classpath, allowing arbitrary code execution. No patch availability information is documented in the provided advisory text.
Affected products
- Spring Integration 7.1.0, 7.0.0–7.0.5, 6.5.0–6.5.10, 6.4.0–6.4.12, 5.5.21 and earlier
Timeline
- 2026-08-27: disclosed