CVE-2026-59324: fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

Published Aug 27, 2026
·
Updated

When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Affected Software

1 affected component
Spring Spring Integration>=7.1.0<=7.1.0, >=7.0.0<7.0.6, >=6.5.0<=6.5.10, >=6.4.0<=6.4.12, <=5.5.21

Event History

Aug 27, 2026
CVE Published
via MITRE·06:04 PM
Data Sourced
via MITRE·06:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverity

Frequently Asked Questions

1

Which deployments are exposed to cross-message header leakage?

Deployments are exposed when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering fluxFunction that emits raw payloads, and concurrent requests share the same FluxMessageChannel subscription. The affected versions listed are Spring Integration 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, and 5.5.21 and earlier.

2

What does an attacker need to exploit this issue?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. Exploitation depends on requests being processed concurrently through the affected asynchronous or reordering .fluxTransform() flow.

3

What information or routing behavior can be affected?

A message can receive replyChannel, errorChannel, correlationId, and propagated security or tenant headers copied from whichever upstream message was consumed most recently. This can expose confidential header data and cause replies or errors to be associated with another request.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203