CVE-2026-47880

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier

Description A producer capable of publishing to a JMS destination consumed by any Spring Integration JMS inbound component can manipulate the Spring Integration MessageHeaders. This occurs because String JMS properties named replyChannel, errorChannel, or json TypeId are copied verbatim into the headers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.