CVE-2026-59307highCWE-502

CVE-2026-59307: falha de alta gravidade em Spring Integration

Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Spring Integration

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8epss 0.4%
An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Spring · Spring Integration
CVEs relacionadas — Spring Integration

No mesmo produto, das mais perigosas para as menos.

CVE-2026-47864MEDIUMUnsafe Java deserialization in SerializingHttpMessageConverter — remote code executionEPSS 5.9%CVE-2019-3772—Spring Integration XML External Entity Injection (XXE)EPSS 3.0%CVE-2026-59274MEDIUMUnbounded decompression in UnZipTransformer enables zip-bomb DoSEPSS 0.4%CVE-2026-59311MEDIUMFixed predictable /tmp/ziptransformer work directory enables symlink pre-creationEPSS 0.4%CVE-2026-47861MEDIUMUDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=falseEPSS 0.3%CVE-2026-47856MEDIUMJsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-listEPSS 0.3%