CVE-2026-59321 Shared JSR-223 ScriptEngine evaluated concurrently without THREADING check

What is CVE-2026-59321?

CVE-2026-59321 is a medium-severity vulnerability in Spring Integration, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers bindings into another message's script evaluation or throwing spurious exceptions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Weakness: CWE-362

Which versions are affected by CVE-2026-59321?

It affects 1 product.

Products include Vmware Spring Integration.

How do I fix CVE-2026-59321?

Upgrade to a fixed version.

Is CVE-2026-59321 being exploited?

There is no known exploitation of CVE-2026-59321 in the wild and no public exploit code.

Other vulnerabilities in Spring Integration

• CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction High 8.2
• CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference High 8.0
• CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem High 7.1
• CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation Medium 6.8
• CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1 Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jwww-wmvq-qm8j.