CVE-2026-59322

6.3 mediumEPSS 0.3%

Medium (6.3) in vmware spring integration. EPSS 0.3% chance of exploitation in the next 30 days.

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Severity

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2026-08-27
Modified: 2026-09-01
Record from: the NVD, synced 2026-10-19

Affected

vmware:spring_integration

References

https://spring.io/security/cve-2026-59322

Check your stack JSON