CVE-2026-59322 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders
Attackers can exploit unsafe JSON header deserialization in Spring Integration to achieve code execution or privilege escalation via crafted messages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59322?
CVE-2026-59322 is a medium-severity unsafe deserialization vulnerability in Spring Integration, published on 27 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Weakness: CWE-20
Which versions are affected by CVE-2026-59322?
It affects 1 product.
Products include Vmware Spring Integration.
How do I fix CVE-2026-59322?
Upgrade to a fixed version.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-59322 being exploited?
There is no known exploitation of CVE-2026-59322 in the wild and no public exploit code.
Other vulnerabilities in Spring Integration
- CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
- CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
- CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
- CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
- CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1
Sources
Also known as CLSA-2026-1791228558, GHSA-9f64-m822-6qq6.