CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
Attackers can bypass deserialization allow-lists in Spring Integration when using Spring-managed beans, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59307?
CVE-2026-59307 is a high-severity unsafe deserialization vulnerability in Spring Integration, published on 27 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
Weakness: CWE-502
Which versions are affected by CVE-2026-59307?
It affects 1 product.
Products include Vmware Spring Integration.
How do I fix CVE-2026-59307?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-59307 being exploited?
There is no known exploitation of CVE-2026-59307 in the wild and no public exploit code.
Other vulnerabilities in Spring Integration
- CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
- CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
- CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
- CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1
- CVE-2026-59274 Unbounded decompression in UnZipTransformer enables zip-bomb DoS
Sources
Also known as GHSA-7336-836q-wfv9.