CVE-2026-59324: fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to cross-message header leakage?
Deployments are exposed when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering fluxFunction that emits raw payloads, and concurrent requests share the same FluxMessageChannel subscription. The affected versions listed are Spring Integration 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, and 5.5.21 and earlier.
What does an attacker need to exploit this issue?
The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. Exploitation depends on requests being processed concurrently through the affected asynchronous or reordering .fluxTransform() flow.
What information or routing behavior can be affected?
A message can receive replyChannel, errorChannel, correlationId, and propagated security or tenant headers copied from whichever upstream message was consumed most recently. This can expose confidential header data and cause replies or errors to be associated with another request.