CVE-2026-47864: Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Integrationto a version that resolves this vulnerability.Fixed in 5.5.21 - Upgrade
Upgrade
Spring Integrationto a version that resolves this vulnerability.Fixed in 6.4.0 - 6.4.12 - Upgrade
Upgrade
Spring Integrationto a version that resolves this vulnerability.Fixed in 6.5.0 - 6.5.10 - Upgrade
Upgrade
Spring Integrationto a version that resolves this vulnerability.Fixed in 7.0.0 - 7.0.5 - Upgrade
Upgrade
Spring Integrationto a version that resolves this vulnerability.Fixed in 7.1.0
Event History
Frequently Asked Questions
Which deployments are actually exposed to remote code execution?
An application is exposed if it uses SerializingHttpMessageConverter on an inbound HTTP endpoint and has a known Java deserialization gadget on its classpath. The vulnerable request format is application/x-java-serialized-object.
Does exploitation require authentication or user interaction?
No. The description states that a remote, unauthenticated attacker can exploit the issue when the affected converter is exposed on an inbound HTTP endpoint and a usable gadget is present.
What must an attacker provide to trigger the vulnerable behavior?
The attacker must send an HTTP request with Content-Type application/x-java-serialized-object and a body that resolves to a Serializable type. The converter reads that body through ObjectInputStream.readObject() without class filtering.
Which Spring Integration versions are listed as affected?
Affected versions are 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; and 5.5.21 and earlier.