CVE-2026-47856

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier

Description JSON to object conversion in Spring Integration uses the json TypeId header to determine the deserialization target type. This process resolves the header value to a class using the ClassUtils.forName function without employing a type or package allow-list, which can lead to insecure deserialization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.