Executive brief
Spring Integration is a framework that processes messages between enterprise applications. A vulnerability allows an attacker who can publish messages to a JMS message queue to inject malicious header values that bypass Spring Integration's internal security controls. This could enable attackers to manipulate message routing, trigger error handlers, or exploit downstream systems that process these messages.
Technical details
The vulnerability is a message header injection flaw in Spring Integration's JMS inbound adapter. When processing JMS messages, Spring Integration copies String JMS properties (replyChannel, errorChannel, json__TypeId__) directly into Spring Integration MessageHeaders without validation or filtering. An unauthenticated producer with write access to the target JMS destination can craft JMS properties that override critical message routing and type metadata. This affects the JMS inbound channel adapter component and allows attackers to redirect message flow or influence deserialization behavior. Patches are available for all affected versions.
Affected products
- VMware Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, 7.1.0
Timeline
- 2026-08-27: disclosed