Threats Tagged 'ghsa-hwxv-6jph-89hg'

CVE-2026-47864 is a deserialization vulnerability in Spring Integration's SerializingHttpMessageConverter. It deserializes HTTP request bodies with a raw ObjectInputStream without class filtering, allowing remote unauthenticated attackers to execute arbitrary code if a suitable Java deserialization gadget is present on the classpath. The vulnerability affects multiple versions of Spring Integration including 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The CVSS score is 6.4 (medium severity). No official patch or remediation guidance is currently provided.