CVE-2026-47856 JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

What is CVE-2026-47856?

CVE-2026-47856 is a medium-severity unsafe deserialization vulnerability in Spring Integration, published on 26 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Weakness: CWE-502

Which versions are affected by CVE-2026-47856?

It affects 1 product.

Products include Vmware Spring Integration.

How do I fix CVE-2026-47856?

Upgrade to a fixed version.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2026-47856 being exploited?

There is no known exploitation of CVE-2026-47856 in the wild and no public exploit code.

Other vulnerabilities in Spring Integration

• CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction High 8.2
• CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference High 8.0
• CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem High 7.1
• CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation Medium 6.8
• CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1 Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-DC84124, CLSA-2026-1789669141, GHSA-647v-4254-wp99.