Do Son 
Two high-severity Spring Integration vulnerabilities threaten application security. Specifically, CVE-2026-59307 allows remote code execution via a deserialization flaw. Meanwhile, CVE-2026-59324 causes information disclosure through cross-message header leakage.
Why It Matters
Furthermore, these Spring Integration vulnerabilities expose enterprise systems to severe risks. Attackers can execute arbitrary code or steal sensitive data from concurrent user sessions. Consequently, administrators must act quickly to secure their environments.
Mechanism of CVE-2026-59307
Specifically, the JdbcMessageStore class ignores configured allow-lists when operating as a Spring-managed bean. Subsequently, the container calls setBeanClassLoader and creates a new permit-all converter. However, the row mapper keeps a stale reference to the old instance. Therefore, the allow-list is never checked. Ultimately, an attacker who writes malicious bytes into the INT_MESSAGE.MESSAGE_CONTENT column achieves Java deserialization remote code execution.
Mechanism of CVE-2026-59324
Similarly, the fluxTransform() method handles asynchronous operations unsafely. During this process, concurrent requests on a single FluxMessageChannel subscription overwrite reply headers. Next, the system copies headers from the most recently consumed message. As a result, one user receives another user’s response payload. Thus, this flaw leads to direct information disclosure.
Affected Versions
Unfortunately, the advisory in O.pdf omits specific version numbers. Currently, exact install counts remain unknown. Therefore, administrators should consult the advisory for CVE-2026-59307 and CVE-2026-59324 to confirm impacted software builds.
Mitigation Steps
First, users must upgrade to fixed versions immediately. Alternatively, for the header leakage flaw, developers can alter the function signature. Specifically, you can change the argument to Function<? super Flux<Message<I>>, ? extends Publisher<Message<O>>> fluxFunction. Finally, security teams have not confirmed any active exploitation in the wild for either flaw.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
