CVE-2026-59322

Name of the Vulnerable Software and Affected Versions Spring Integration versions 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier

Description The EmbeddedHeadersJsonMessageMapper uses an overly permissive header parsing posture in its constructor. When the decodeNativeFormat() function processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and creates a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.