CVE-2026-47864: Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

Published Aug 27, 2026
·
Updated

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Affected Software

5 affected components
Spring Spring Integration>=7.0.0<=7.0.5
Spring Spring Integration>=6.5.0<=6.5.10
Spring Spring Integration>=6.4.0<=6.4.12
Spring Spring Integration<=5.5.21
Spring Spring Integration=7.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Spring Integration to a version that resolves this vulnerability.

    Fixed in 5.5.21
  2. Upgrade

    Upgrade Spring Integration to a version that resolves this vulnerability.

    Fixed in 6.4.0 - 6.4.12
  3. Upgrade

    Upgrade Spring Integration to a version that resolves this vulnerability.

    Fixed in 6.5.0 - 6.5.10
  4. Upgrade

    Upgrade Spring Integration to a version that resolves this vulnerability.

    Fixed in 7.0.0 - 7.0.5
  5. Upgrade

    Upgrade Spring Integration to a version that resolves this vulnerability.

    Fixed in 7.1.0

Event History

Aug 27, 2026
CVE Published
via MITRE·05:06 AM
Data Sourced
via MITRE·05:06 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverity

Frequently Asked Questions

1

Which deployments are actually exposed to remote code execution?

An application is exposed if it uses SerializingHttpMessageConverter on an inbound HTTP endpoint and has a known Java deserialization gadget on its classpath. The vulnerable request format is application/x-java-serialized-object.

2

Does exploitation require authentication or user interaction?

No. The description states that a remote, unauthenticated attacker can exploit the issue when the affected converter is exposed on an inbound HTTP endpoint and a usable gadget is present.

3

What must an attacker provide to trigger the vulnerable behavior?

The attacker must send an HTTP request with Content-Type application/x-java-serialized-object and a body that resolves to a Serializable type. The converter reads that body through ObjectInputStream.readObject() without class filtering.

4

Which Spring Integration versions are listed as affected?

Affected versions are 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; and 5.5.21 and earlier.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203