CVE-2026-47856: JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list
Spring Integration's JSON to object conversion uses the jsonTypeId header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs low-level privileges and network access, but no user interaction is required. Exploitation depends on being able to supply or influence a message carrying the json__TypeId__ header.
Which releases are affected?
Affected releases are Spring Integration 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, and 5.5.21 and earlier.
How can I determine whether my deployment is exposed?
Check whether your application uses Spring Integration JSON-to-object conversion and accepts messages whose json__TypeId__ header can be influenced by a low-privileged network-accessible sender. The affected transformer resolves that header to a class without a type or package allow-list.