CVE-2026-59324 fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
Concurrent requests in Spring Integration may leak sensitive reply headers due to a race condition in fluxTransform, exposing security and tenant data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59324?
CVE-2026-59324 is a high-severity vulnerability in Spring Integration, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Weakness: CWE-362
Which versions are affected by CVE-2026-59324?
It affects 1 product.
Products include Vmware Spring Integration.
How do I fix CVE-2026-59324?
Upgrade to a fixed version.
Is CVE-2026-59324 being exploited?
There is no known exploitation of CVE-2026-59324 in the wild and no public exploit code.
Other vulnerabilities in Spring Integration
- CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference
- CVE-2026-40987 Spring Integration File Support: FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem
- CVE-2026-59311 Fixed predictable /tmp/ziptransformer work directory enables symlink pre-creation
- CVE-2026-59293 SMB minimum protocol dialect defaults to SMB1
- CVE-2026-59274 Unbounded decompression in UnZipTransformer enables zip-bomb DoS
Sources
Also known as GHSA-37gx-w2pf-9hpp.