Executive brief
Spring Integration's JdbcMessageStore allows developers to configure allowed patterns to restrict unsafe Java object deserialization. However, when the store is configured as a Spring-managed bean, these restriction patterns are ignored entirely, leaving the application vulnerable to remote code execution through crafted serialized objects. This affects operators who intentionally configured deserialization restrictions but receive no actual protection due to the misconfiguration.
Technical details
The vulnerability is a deserialization restriction bypass in Spring Integration's JdbcMessageStore component. When an operator calls addAllowedPatterns(...) to whitelist safe classes for deserialization, the restrictions are not applied if the store is managed as a Spring bean rather than instantiated directly. An attacker who can control serialized objects stored in or flowing through the message store (typically requiring network access or the ability to inject messages) can craft malicious payloads that exploit Java deserialization to achieve remote code execution. The issue stems from the allowed patterns not being properly enforced in the Spring-managed context. Patches are available in Spring Integration 6.4.13, 6.5.11, and 7.0.6 or later.
Affected products
- Spring Integration 6.4.0 - 6.4.12, 6.5.0 - 6.5.10, 7.0.0 - 7.0.5, 7.1.0
Timeline
- 2026-08-27: disclosed