CVE-2026-47856

Overview

Spring Integration extends the Spring programming model to support the well-known Enterprise Integration Patterns, providing message channels, endpoints, transformers, and channel adapters that let Spring applications exchange data with external systems over protocols such as HTTP, JMS, AMQP, TCP/UDP, syslog, and the file system.

A Remote Code Execution (RCE) vulnerability (CVE-2026-47856) has been identified in the JsonToObjectTransformer component of Spring Integration, which allows attackers to choose the class that an inbound JSON payload is bound to by setting the json__TypeId__ type-id message header, and so to have the framework load and instantiate arbitrary classes from the application classpath.

Per OWASP: Data which is untrusted cannot be trusted to be well formed. Malformed data or unexpected data could be used to abuse application logic, deny service, or execute arbitrary code, when deserialized.

The Spring project publishes the CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L for this vulnerability, which yields a base score of 6.3 (Medium). The attack is carried out over the network with low attack complexity and no user interaction, and privileges are Low because the attacker must be able to publish messages onto a destination that the application consumes from. The confidentiality, integrity, and availability impacts are each rated Low rather than High because the reachable outcome is bounded by the classes that the application's own classpath makes available to the type-id header.

This issue affects the JSON transformer support of Spring Integration.

‍

Details

Module Info

• Product: Spring Integration
• Affected packages: org.springframework.integration:spring-integration-core
• Affected versions: >= 3.0.0 <= 5.5.21, >= 6.0.0 <= 6.4.12, >= 6.5.0 <= 6.5.10, >= 7.0.0 < 7.0.6, >= 7.1.0 < 7.1.1
• GitHub repository: https://github.com/spring-projects/spring-integration
• Published packages: https://central.sonatype.com/artifact/org.springframework.integration/spring-integration-core
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Integration lines 5.5.x, 6.2.x, 6.3.x, 6.4.x and 6.5.x
  • OSS Spring Integration 7.0.6 and 7.1.1

Vulnerability Info

This Medium-severity vulnerability is found in the org.springframework.integration:spring-integration-core package in the JSON transformer support of Spring Integration.

Unless a value-type expression is configured, JsonToObjectTransformer evaluates a default expression that derives the deserialization target from the message headers, ahead of any target type supplied through the constructor. The type id carried in the json__TypeId__ header is resolved straight to a Class and handed to the object mapper:

@Override
protected Object doTransform(Message<?> message) {
    ResolvableType valueType = obtainResolvableType(message);

    boolean removeHeaders = false;
    if (valueType != null) {
        removeHeaders = true;
    }
    else {
        valueType = this.targetType;
    }

    Object result;
    try {
        result = this.jsonObjectMapper.fromJson(message.getPayload(), valueType);
    }
    catch (IOException e) {
        throw new UncheckedIOException(e);
    }
    ...
}

private static @Nullable ResolvableType obtainResolvableTypeFromHeadersIfAny(MessageHeaders headers,
        ClassLoader classLoader) {

    Object valueType = headers.get(JsonHeaders.RESOLVABLE_TYPE);
    Object typeIdHeader = headers.get(JsonHeaders.TYPE_ID);
    if (!(valueType instanceof ResolvableType) && typeIdHeader != null) {
        valueType =
                JsonHeaders.buildResolvableType(classLoader, typeIdHeader,
                        headers.get(JsonHeaders.CONTENT_TYPE_ID), headers.get(JsonHeaders.KEY_TYPE_ID));
    }
    return valueType instanceof ResolvableType resolvableType
            ? resolvableType
            : null;
}

There is no package or class allow-list between the header value and the class load. Inbound header mappers for transports such as AMQP and Kafka copy the JSON type-id headers from the wire into the Spring Integration message, so a remote producer controls typeIdHeader and therefore controls which type the payload is bound into. Depending on the classes available on the application classpath, that primitive can be escalated from unexpected object instantiation to arbitrary code execution. Configuring a target type on the transformer does not avoid this path: doTransform resolves the value-type expression first and falls back to the constructor-supplied target type only when that expression yields no type, so a transformer constructed with an explicit target class still binds the payload to the attacker's class whenever the json__TypeId__ header is present. Only replacing the default expression, through setValueTypeExpression or setValueTypeExpressionString, suppresses the header-derived path.

This vulnerability was introduced in 2013 with Spring Integration 3.0.0.

‍

Mitigation

Only recent versions of Spring Integration receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Integration.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Uwez Khan (finder)