CVE-2026-59324
HighCVSS 8.2Summary
In Spring Integration, when an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers copied from whichever message was most recently consumed upstream. Affected versions include 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.
Risk Assessment
The risk involves potential mixing of response contexts between requests, which could lead to incorrect routing of responses or information leakage between sessions.
Recommendation
It is recommended to upgrade Spring Integration to a patched version or avoid using .fluxTransform() with asynchronous functions in concurrent environments.
Original NVD description (English source)
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier