CVE-2026-59324: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Spring Spring Integration

This vulnerability involves improper synchronization (CWE-362) in Spring Integration's handling of concurrent executions using shared resources. Specifically, when using .fluxTransform() with an asynchronous or reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription may have their reply headers (including replyChannel, errorChannel, correlationId, and propagated security or tenant headers) incorrectly copied from whichever message was most recently consumed upstream. This can lead to incorrect message handling and potential information leakage or misrouting of messages. The affected versions include Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0.

The vulnerability can cause confidentiality impacts due to incorrect copying of reply headers, potentially exposing sensitive information or causing messages to be misrouted. The integrity impact is low, as the issue primarily affects header copying rather than message content modification. There is no availability impact reported. The CVSS score of 8.2 reflects a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is indicated in the provided data. Users should monitor vendor communications for patches or mitigations addressing this race condition vulnerability.