CVE-2026-47880: DefaultJmsHeaderMapper copies all JMS user properties into MessageHeaders without excluding framework-significant names
A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or jsonTypeId which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any Spring Integration JMS inbound component that consumes messages from a destination where a producer can publish is exposed if it uses DefaultJmsHeaderMapper and the producer can set JMS String properties. The affected releases listed are 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, and 5.5.21 and earlier.
What access does an attacker need?
An attacker needs permission to publish a JMS message to a destination consumed by a Spring Integration JMS inbound component. No user interaction is required, but the attacker must be able to set String JMS properties on the message.
Which message properties are relevant to exploitation?
The described framework-significant property names are replyChannel, errorChannel, and json__TypeId__. DefaultJmsHeaderMapper copies these JMS user properties into Spring Integration MessageHeaders without excluding them.