Java Deserialization Vulnerability in Spring Integration by VMware
CVE-2026-47864

6.4MEDIUM

Key Information:

Vendor

Spring

Status
Spring Integration
Vendor
CVE Published:
27 August 2026

What is CVE-2026-47864?

The vulnerability in Spring Integration allows unauthenticated attackers to exploit deserialization issues in HTTP request handling. By sending a specially crafted request with a Content-Type of 'application/x-java-serialized-object', an attacker can invoke a remote code execution scenario if the application’s classpath includes known Java deserialization gadgets. This poses a significant risk, particularly in applications utilizing the SerializingHttpMessageConverter, as it can lead to unintended consequences, potentially compromising the integrity of the affected application.

Affected Version(s)

Spring Integration 7.1.0

Spring Integration 7.0.0 <= 7.0.5

Spring Integration 6.5.0 <= 6.5.10

References

https://spring.io/security/cve-2026-47864

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.