Description

An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-27T20:17:57.103Z",
  "pubdate": "2026-08-27T20:17:57.103Z",
  "executiveSummary": "A critical vulnerability exists in Spring Integration where the JdbcMessageStore fails to enforce deserialization allow-lists when configured as a Spring-managed bean.\nThe vulnerability allows for remote code execution or arbitrary object instantiation due to the failure of the addAllowedPatterns() method to properly restrict the deserialization process.\nThis flaw impacts multiple versions of Spring Integration, including 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, and 6.4.0-6.4.12.\nThe risk is significant, as an attacker with the ability to inject malicious serialized objects into the underlying database or message store can bypass security controls intended to prevent unsafe deserialization.\nExploitation does not necessarily require deep system access if an attacker can influence the data persisted within the JdbcMessageStore. Organizations relying on default deserialization configurations for JdbcMessageStore are at high risk of unauthorized object injection attacks.",
  "technicalDetails": "The vulnerability originates in the initialization and lifecycle management of the JdbcMessageStore when instantiated within the Spring ApplicationContext. Specifically, the mechanism designed to restrict deserialized classes via the addAllowedPatterns() function is rendered ineffective due to improper configuration state management within the bean's lifecycle.\nIn Spring Integration versions 7.1.0, 7.0.0 - 7.0.5, 6.5.0 - 6.5.10, and 6.4.0 - 6.4.12, the JdbcMessageStore uses a deserialization strategy that relies on the AllowListDeserializingConverter. When the component is defined as a Spring-managed bean, the internal state required to enforce the allow-list is not correctly propagated or synchronized when the addAllowedPatterns() method is invoked after bean construction but prior to deserialization operations.\nThe attack flow initiates when an attacker gains the ability to place a crafted, serialized malicious object into the persistence layer utilized by the JdbcMessageStore. Because the allow-list mechanism is effectively bypassed, the JdbcMessageStore defaults to its underlying deserialization behavior, which may not successfully validate the incoming object stream against the intended safe class patterns.\nUpon retrieval of the message from the store, the application triggers the deserialization process. The vulnerable component proceeds to deserialize the payload without applying the restricted pattern constraints. This allows for the instantiation of arbitrary classes present in the application's classpath that are capable of executing malicious logic (gadget chains) during the object reconstruction process.\nThe failure is localized to the interaction between the Spring bean lifecycle management and the internal deserializer configuration. Because the protection mechanism is bypassed, the deserializer operates under an overly permissive policy, effectively nullifying the developer's attempt to harden the integration against insecure deserialization. The impact is a total compromise of the application's deserialization security boundary, enabling remote code execution (RCE) if suitable gadget chains are available in the classpath, or unauthorized state manipulation if the application's internal object model can be compromised through serialized injection."
}