CVE-2026-47864

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier

Description The SerializingHttpMessageConverter deserializes the body of incoming HTTP requests using a raw java.io.ObjectInputStream without class filtering. When a request is sent with the Content-Type application/x-java-serialized-object and the body resolves to a Serializable type, it is processed directly via the readObject() function. If the application has a Java deserialization gadget—a chain of existing classes that can be exploited during deserialization—on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.