CVE-2026-59324

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier

Description An issue exists when an IntegrationFlow utilizes the .fluxTransform() method with an asynchronous or reordering fluxFunction that emits raw payloads. In this scenario, concurrent requests on the same FluxMessageChannel subscription may have their reply headers—including replyChannel, errorChannel, correlationId, and any propagated security or tenant headers—incorrectly copied from the message most recently consumed upstream.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.