Asynchronous Flux Transformation Vulnerability in Spring Integration by Pivotal Software
CVE-2026-59324

8.2HIGH

Key Information:

Vendor

Spring

Status
Spring Integration
Vendor
CVE Published:
27 August 2026

What is CVE-2026-59324?

This vulnerability arises in Spring Integration when an IntegrationFlow utilizes the .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads. In scenarios where concurrent requests are made on the same FluxMessageChannel subscription, the reply headers—including replyChannel, errorChannel, correlationId, and any propagated security or tenant headers—may be incorrectly copied from the most recently consumed upstream message. This issue can lead to unintended exposure of sensitive information or misrouted messages, underscoring the importance of implementing proper synchronization and configuration management in asynchronous processing environments.

Affected Version(s)

Spring Integration 7.1.0

Spring Integration 7.0.0 <= 7.0.5

Spring Integration 6.5.0 <= 6.5.10

References

https://spring.io/security/cve-2026-59324

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.