CVE-2026-47864mediumCWE-502

CVE-2026-47864: falha de média gravidade em Spring Integration

Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring Integration

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.4epss 5.9%
SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Produtos afetados
Spring · Spring Integration
CVEs relacionadas — Spring Integration

No mesmo produto, das mais perigosas para as menos.

CVE-2019-3772—Spring Integration XML External Entity Injection (XXE)EPSS 3.0%CVE-2026-59274MEDIUMUnbounded decompression in UnZipTransformer enables zip-bomb DoSEPSS 0.4%CVE-2026-59307HIGHDeserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale referenceEPSS 0.4%CVE-2026-59311MEDIUMFixed predictable /tmp/ziptransformer work directory enables symlink pre-creationEPSS 0.4%CVE-2026-47861MEDIUMUDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=falseEPSS 0.3%CVE-2026-47856MEDIUMJsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-listEPSS 0.3%