CVE-2026-59321: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Spring Spring Integration

This vulnerability arises from improper synchronization when reusing a single ScriptEngine instance across concurrent messages in Spring Integration. Specifically, JSR-223 script engines that report THREADING=null (indicating they are not thread-safe, such as the Kotlin kts engine) can have their internal state corrupted during concurrent access. This can lead to cross-message data leakage or spurious exceptions during script evaluation. The affected versions include Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0.

The vulnerability can cause leakage of message payloads and headers between concurrent script evaluations, potentially exposing sensitive data across messages. It can also cause unexpected exceptions, disrupting normal message processing. The impact is limited to confidentiality and integrity with no reported availability impact.

No official patch or remediation level is currently provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using non-thread-safe JSR-223 engines like the Kotlin kts engine in concurrent script-backed channels or implement external synchronization to prevent concurrent access to the ScriptEngine instance.