Description

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-27T06:17:17.960Z",
  "pubdate": "2026-08-27T06:17:17.960Z",
  "executiveSummary": "A vulnerability exists in Spring Integration JMS inbound components allowing unauthorized JMS producers to inject arbitrary header values into MessageHeaders.\nThe vulnerability type is improper input validation, leading to potential header injection. This flaw allows an attacker to influence message routing and object deserialization by manipulating properties such as replyChannel, errorChannel, or json__TypeId__.\nAffected products include Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.\nRisk implications are high, as an attacker with the ability to publish messages to a JMS destination can control the internal flow of the application or trigger unsafe deserialization processes.\nThe attack requires network access to the JMS broker utilized by the Spring Integration inbound endpoint. No prior authentication is explicitly required if the JMS destination is reachable, and the vulnerability exploits the trust placed in properties provided within the JMS message envelope.\nSuccessful exploitation results in unauthorized control over integration message channels or potential Remote Code Execution (RCE) via manipulated type identifiers.",
  "technicalDetails": "The vulnerability stems from the insecure handling of JMS message properties by Spring Integration JMS inbound components. When a message is consumed, the component extracts specific JMS properties and copies them directly into the Spring Integration MessageHeaders without validation or sanitization.\nSpecifically, the properties 'replyChannel', 'errorChannel', and 'json__TypeId__' are treated as trusted input. By setting these properties on a JMS message before publishing, an attacker can influence the behavior of the integration pipeline.\nThe 'replyChannel' and 'errorChannel' headers control the routing of messages within the integration flow. An attacker can redirect responses or error messages to arbitrary channels or endpoints defined within the application context, facilitating data exfiltration or denial-of-service scenarios.\nThe 'json__TypeId__' property is particularly critical; it is often used by JSON message converters to determine the target class for deserialization. By manipulating this header, an attacker may be able to force the application to instantiate arbitrary classes available on the classpath, leading to Remote Code Execution (RCE) if gadget chains are present.\nThe attack flow follows these steps: 1) An attacker connects to the message broker used by the target Spring Integration application. 2) The attacker crafts a malicious JMS message, injecting the target headers (replyChannel, errorChannel, or json__TypeId__) into the JMS property set. 3) The attacker publishes this message to a destination consumed by the vulnerable Spring Integration component. 4) The Spring Integration component consumes the message and copies the malicious properties into the resulting MessageHeaders. 5) Subsequent components in the integration chain consume these headers, causing the application to follow the attacker-defined routing logic or perform insecure deserialization based on the manipulated type identifier.\nThe vulnerability affects multiple versions across different branches: 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, and all versions 5.5.21 and earlier. It is present in any component that automatically maps JMS headers to Spring Integration headers."
}