Skip to content
VMwareCVE-2026-59322

VMware Spring Integration: improper input validation

Medium6.3CVE-2026-59322 · Published Aug 27, 2026 · updated Sep 1, 2026

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

VMware advisory

Affected versions

PackageAffectedFixed in
Spring Integration
Product
<= 7.1.0No fix yet
>= 7.0.0, <= 7.0.5No fix yet
>= 6.5.0, <= 6.5.10No fix yet
>= 6.4.0, <= 6.4.12No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-20

More VMware advisories

All VMware
Advisory
VMware Spring AMQP: resource leak
Medium6.5Aug 27
VMware Spring Integration: race condition
Medium4.2Aug 27
VMware Spring Integration: race condition
High8.2Aug 27
VMware Spring Integration: unsafe deserialization
High8.0Aug 27
VMware Spring Integration: link following
Medium6.8Aug 27
Spring MVC applications using the functional web framework are vulnerable to...
Critical9.8Aug 27

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.