Executive brief
Spring Integration's message mapping component defaults to overly permissive header parsing when processing JSON-formatted messages. This allows attackers to inject arbitrary header names into message objects without validation, potentially enabling header spoofing attacks or exploitation of downstream components that trust message headers. The vulnerability affects multiple versions of the framework used in enterprise messaging applications.
Technical details
The EmbeddedHeadersJsonMessageMapper class deserializes untrusted JSON headers into a plain Map and constructs GenericMessage objects with MutableMessageHeaders without sanitizing or filtering header names. The decodeNativeFormat method processes raw byte payloads and accepts embedded JSON headers without validation by default. An attacker can craft malicious message payloads with specially crafted header names to inject headers into message objects. The vulnerability requires network access to send crafted messages to an application using Spring Integration. Patches are available in Spring Integration 7.1.0, 7.0.6+, 6.5.11+, and 6.4.13+, and users on 5.5.21 and earlier should upgrade.
Affected products
- Spring Spring Integration 5.5.21 and earlier, 6.4.0–6.4.12, 6.5.0–6.5.10, 7.0.0–7.0.5, 7.1.0
Timeline
- 2026-08-27: disclosed: Public disclosure of CVE-2026-59322