CVE-2026-47864: CWE-502 Deserialization of Untrusted Data in Spring Spring Integration

The vulnerability arises because SerializingHttpMessageConverter in Spring Integration deserializes incoming HTTP requests with Content-Type application/x-java-serialized-object using java.io.ObjectInputStream without any class filtering. This allows any Serializable type in the request body to be deserialized directly via readObject(). If the application has known Java deserialization gadgets on its classpath, a remote attacker can exploit this to achieve arbitrary code execution without authentication. Affected versions include Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The vulnerability is tracked as CWE-502.

Successful exploitation allows a remote unauthenticated attacker to execute arbitrary code on the affected system, potentially leading to confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high confidentiality impact with low integrity and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing endpoints that use SerializingHttpMessageConverter to untrusted networks or requests with Content-Type application/x-java-serialized-object. Consider disabling or restricting deserialization of untrusted data or implementing class filtering if possible.