CVE-2026-59322: EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Affected Software
Event History
Frequently Asked Questions
Which Spring Integration versions are affected?
Affected versions are 7.1.0; 7.0.0 through 7.0.5; 6.5.0 through 6.5.10; 6.4.0 through 6.4.12; and 5.5.21 and earlier.
Is a custom header-parsing configuration required for exposure?
No. The issue is in the default constructor behavior of EmbeddedHeadersJsonMessageMapper, which uses an overly permissive header parsing posture by default.
What conditions are needed for exploitation?
The vulnerable processing path is decodeNativeFormat handling raw byte payloads containing embedded JSON headers. The supplied vector indicates network reachability, low attack complexity, low required privileges, and no user interaction.