CVE-2026-47880: CWE-20 Improper Input Validation in Spring Spring Integration

This vulnerability arises from improper input validation (CWE-20) in Spring Integration's JMS inbound components. A JMS message producer able to publish to a JMS destination consumed by Spring Integration can set String JMS properties named replyChannel, errorChannel, or json__TypeId__. These properties are copied verbatim into the Spring Integration MessageHeaders, potentially allowing manipulation of message routing or processing behavior. The affected versions include 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0.

An attacker with the ability to publish JMS messages to a destination consumed by Spring Integration JMS inbound components can influence message headers by setting specific JMS properties. This may lead to unintended message routing or processing, impacting confidentiality and integrity of message handling. The CVSS score is 5.4 (medium), indicating limited impact on confidentiality and integrity, with no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Until a patch is available, restrict JMS message producers to trusted sources and validate or sanitize JMS message properties before they are processed by Spring Integration components.