Script Engine Reuse Issue in Spring Integration by Pivotal Software
CVE-2026-59321

4.2MEDIUM

Key Information:

Vendor

Spring

Status
Spring Integration
Vendor
CVE Published:
27 August 2026

What is CVE-2026-59321?

A security flaw exists in Spring Integration where a single ScriptEngine instance is reused for each message on script-backed channels. This issue particularly affects JSR-223 engines that report THREADING=null, indicating they are not thread-safe. As a result, concurrent message processing can lead to the corruption of the engine's internal state. This vulnerability may cause payload and header information from one message to unintentionally leak into another message's script evaluation or trigger unexpected exceptions, which compromises the integrity and confidentiality of message processing.

Affected Version(s)

Spring Integration 7.1.0

Spring Integration 7.0.0 <= 7.0.5

Spring Integration 6.5.0 <= 6.5.10

References

https://spring.io/security/cve-2026-59321

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.