{"id":"CVE-2026-59307","aliases":["CLSA-2026-1790097561","CLSA-2026-1791398579","CLSA-2026-1791906184","CLSA-2026-1791922759","EUVD-2026-67192","GHSA-7336-836q-wfv9"],"status":"published","title":"Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference","description":"An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00417,"percentile":0.36275,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2026-08-27T17:58:02Z","modified":"2026-11-02T19:46:27Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.10"},{"fixed":"6.4.10-tuxcare.3"}]}],"versions":["6.4.10","6.4.10-tuxcare.1","6.4.10-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.10"},{"fixed":"6.4.10-tuxcare.3"}]}],"versions":["6.4.10","6.4.10-tuxcare.1","6.4.10-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.10"},{"fixed":"6.4.10-tuxcare.3"}]}],"versions":["6.4.10","6.4.10-tuxcare.1","6.4.10-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.10"},{"fixed":"6.4.10-tuxcare.3"}]}],"versions":["6.4.10","6.4.10-tuxcare.1","6.4.10-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.10"},{"fixed":"6.4.10-tuxcare.3"}]}],"versions":["6.4.10","6.4.10-tuxcare.1","6.4.10-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-scripting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.10"},{"fixed":"6.4.10-tuxcare.3"}]}],"versions":["6.4.10","6.4.10-tuxcare.1","6.4.10-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.10"},{"fixed":"6.4.10-tuxcare.3"}]}],"versions":["6.4.10","6.4.10-tuxcare.1","6.4.10-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-syslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.10"},{"fixed":"6.4.10-tuxcare.3"}]}],"versions":["6.4.10","6.4.10-tuxcare.1","6.4.10-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.10"},{"fixed":"6.4.10-tuxcare.3"}]}],"versions":["6.4.10","6.4.10-tuxcare.1","6.4.10-tuxcare.2"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-file","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-ftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-scripting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-syslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.9"},{"fixed":"6.4.9-tuxcare.2"}]}],"versions":["6.4.9","6.4.9-tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.10"},{"fixed":"6.5.10-tuxcare.2"}]}],"versions":["6.5.10","6.5.10-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.10"},{"fixed":"6.5.10-tuxcare.2"}]}],"versions":["6.5.10","6.5.10-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.10"},{"fixed":"6.5.10-tuxcare.2"}]}],"versions":["6.5.10","6.5.10-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.10"},{"fixed":"6.5.10-tuxcare.2"}]}],"versions":["6.5.10","6.5.10-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.10"},{"fixed":"6.5.10-tuxcare.2"}]}],"versions":["6.5.10","6.5.10-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-scripting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.10"},{"fixed":"6.5.10-tuxcare.2"}]}],"versions":["6.5.10","6.5.10-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.10"},{"fixed":"6.5.10-tuxcare.2"}]}],"versions":["6.5.10","6.5.10-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-syslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.10"},{"fixed":"6.5.10-tuxcare.2"}]}],"versions":["6.5.10","6.5.10-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.10"},{"fixed":"6.5.10-tuxcare.2"}]}],"versions":["6.5.10","6.5.10-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.9"},{"fixed":"6.5.9-tuxcare.1"}]}],"versions":["6.5.9"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.9"},{"fixed":"6.5.9-tuxcare.1"}]}],"versions":["6.5.9"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-ip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.9"},{"fixed":"6.5.9-tuxcare.1"}]}],"versions":["6.5.9"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-jdbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.9"},{"fixed":"6.5.9-tuxcare.1"}]}],"versions":["6.5.9"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-jms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.9"},{"fixed":"6.5.9-tuxcare.1"}]}],"versions":["6.5.9"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-scripting","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.9"},{"fixed":"6.5.9-tuxcare.1"}]}],"versions":["6.5.9"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-smb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.9"},{"fixed":"6.5.9-tuxcare.1"}]}],"versions":["6.5.9"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-syslog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.9"},{"fixed":"6.5.9-tuxcare.1"}]}],"versions":["6.5.9"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.integration:spring-integration-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.9"},{"fixed":"6.5.9-tuxcare.1"}]}],"versions":["6.5.9"],"bundled":14}],"products":[{"vendor":"spring","product":"spring integration"},{"vendor":"spring by vmware","product":"spring integration"},{"vendor":"vmware","product":"spring_integration"}],"references":[{"url":"https://spring.io/security/cve-2026-59307","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59307","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7336-836q-wfv9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59307.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59307","title":"Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference","description":"An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12","status":"published","published":"2026-08-27T17:58:02.683Z","modified":"2026-08-29T03:55:53.369Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-67192","description":"An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12","status":"published","published":"2026-08-27T17:58:02Z","modified":"2026-08-29T03:55:53Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:21.947009Z"}],"ghsa":[{"id":"GHSA-7336-836q-wfv9","title":"An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization...","description":"An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12","status":"published","published":"2026-08-27T21:31:46Z","modified":"2026-08-28T21:31:07Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:11:08.095363Z"}],"nvd":[{"id":"CVE-2026-59307","description":"An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12","status":"published","published":"2026-08-27T20:17:57.103Z","modified":"2026-08-31T18:09:32.27Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-59307","title":"Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference","description":"An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean.\nSpring Integration 7.1.0\nSpring Integration 7.0.0 - 7.0.5\nSpring Integration 6.5.0 - 6.5.10\nSpring Integration 6.4.0 - 6.4.12","status":"published","published":"2026-08-27T17:58:02.683Z","modified":"2026-10-28T02:31:07.473825571Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"CLSA-2026-1790097561","title":"TuxCare security update for org.springframework.integration (12 CVEs)","description":"TuxCare rebuilt 9 org.springframework.integration packages to address 12 CVEs. Fixed in 6.4.10-tuxcare.3.","status":"published","published":"2026-09-22T17:19:21Z","modified":"2026-11-02T19:46:20.181204571Z","updated_at":"2026-11-02T20:29:27.085992Z"},{"id":"CLSA-2026-1791398579","title":"TuxCare security update for org.springframework.integration (11 CVEs)","description":"TuxCare rebuilt 11 org.springframework.integration packages to address 11 CVEs. Fixed in 6.4.9-tuxcare.2.","status":"published","published":"2026-10-07T18:42:59Z","modified":"2026-11-02T19:46:26.322243263Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791906184","title":"TuxCare security update for org.springframework.integration (14 CVEs)","description":"TuxCare rebuilt 9 org.springframework.integration packages to address 14 CVEs. Fixed in 6.5.10-tuxcare.2.","status":"published","published":"2026-10-13T15:43:04Z","modified":"2026-11-02T19:46:27.319835908Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1791922759","title":"TuxCare security update for org.springframework.integration (14 CVEs)","description":"TuxCare rebuilt 9 org.springframework.integration packages to address 14 CVEs. Fixed in 6.5.9-tuxcare.1.","status":"published","published":"2026-10-13T20:19:19Z","modified":"2026-11-02T19:46:27.283847735Z","updated_at":"2026-11-02T20:29:13.152182Z"}]}}