CVE-2026-59307: CWE-502 Deserialization of Untrusted Data in Spring Spring Integration

CVE-2026-59307 describes a deserialization vulnerability in Spring Integration where the method JdbcMessageStore.addAllowedPatterns(...) intended to restrict deserialization does not provide protection when the message store is managed as a Spring bean. This flaw allows potentially unsafe deserialization of untrusted data, which can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability affects specific versions of Spring Integration: 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12. The CVSS vector indicates the attack requires network access and high privileges but no user interaction, with a scope change and high impact on all security properties. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker with high privileges and network access to perform unsafe deserialization, potentially leading to full compromise of confidentiality, integrity, and availability of the affected Spring Integration component. This could result in unauthorized code execution or data manipulation within the application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, operators should be cautious when using JdbcMessageStore.addAllowedPatterns(...) for restricting deserialization, especially when the store is a Spring-managed bean. Consider applying additional security controls around deserialization or limiting exposure of vulnerable components.