CVE-2026-59321

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier

Description A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (indicating they are not thread-safe, such as the Kotlin kts engine), concurrent message processing can corrupt the internal state of the engine. This may lead to the leakage of one message's payload or headers bindings into the script evaluation of another message or cause spurious exceptions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.