CVE-2026-59307
HighCVSS 8.0Summary
In Spring Integration, an operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Affected versions include 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.
Risk Assessment
The risk is that deserialization restrictions are not enforced, potentially allowing an attacker to perform dangerous deserialization operations leading to remote code execution.
Recommendation
It is recommended to upgrade Spring Integration to a patched version or manually enforce deserialization restrictions outside of JdbcMessageStore.
Original NVD description (English source)
An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12