CVE-2026-59322: CWE-20 Improper Input Validation in Spring Spring Integration

The vulnerability arises from the EmbeddedHeadersJsonMessageMapper's constructor defaulting to an overly permissive header parsing approach. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names. This improper input validation (CWE-20) can allow attackers to influence message headers in Spring Integration versions 5.5.21 and earlier, 6.4.0 to 6.4.12, 6.5.0 to 6.5.10, 7.0.0 to 7.0.5, and 7.1.0.

The vulnerability can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). Attackers with network access and low privileges can exploit this flaw without user interaction. The improper input validation may allow manipulation of message headers, potentially causing unexpected behavior or disruption in applications using affected Spring Integration versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating risk by restricting access to trusted sources for message payloads and monitoring for unusual message header activity. Avoid processing untrusted JSON headers if possible.