Description

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers bindings into another message's script evaluation or throwing spurious exceptions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-27T20:17:58.147Z",
  "pubdate": "2026-08-27T20:17:58.147Z",
  "executiveSummary": "A thread safety vulnerability exists in Spring Integration's script-backed channel processing, where a single ScriptEngine instance is incorrectly shared across multiple concurrent messages.\nThis race condition primarily affects JSR-223 engines that are not thread-safe (notably the Kotlin kts engine).\nThe vulnerability allows for cross-thread state corruption, potentially resulting in the leakage of sensitive message payloads or headers between concurrent executions.\nAffected products include Spring Integration 7.1.0, 7.0.0 - 7.0.5, 6.5.0 - 6.5.10, 6.4.0 - 6.4.12, and 5.5.21 and earlier.\nThe impact is significant, as it permits unauthorized access to data in transit within the application context and can lead to denial-of-service via spurious exceptions.\nExploitation does not necessarily require complex attacker capabilities, as it relies on concurrent asynchronous traffic patterns inherent in high-throughput messaging channels.",
  "technicalDetails": "The root cause of this vulnerability is the improper lifecycle management of JSR-223 ScriptEngine instances within Spring Integration’s script-backed channels. In a multithreaded messaging environment, Spring Integration fails to guarantee instance isolation for ScriptEngine implementations that do not support concurrent execution, explicitly those reporting THREADING=null in their metadata.\nWhen a script-backed channel processes messages asynchronously or via a task executor, the framework reuses the same ScriptEngine instance for subsequent invocations. Because the underlying engines—specifically the Kotlin kts engine—are not inherently thread-safe, internal state management (such as variable binding maps or execution context) becomes non-deterministic when multiple threads attempt to manipulate the engine simultaneously.\nThe attack flow occurs during high-concurrency scenarios: 1) Thread A initializes the ScriptEngine with Message A's bindings (payload and headers). 2) Before Thread A completes the script evaluation, Thread B initiates execution using the same engine. 3) Thread B modifies the shared engine state, overwriting or appending data from Message B into the evaluation context of Message A.\nThe technical consequence is the corruption of the script’s execution context. This leads to two primary exploitation vectors: First, information disclosure, where sensitive payload or header data from one message is inadvertently processed or leaked into the scope of another message's execution script. Second, a denial-of-service condition; if the concurrent state manipulation results in a violation of the script engine's internal memory integrity or logic, the engine may throw spurious exceptions, crashing the messaging pipeline or blocking the affected channel thread.\nThe vulnerability is specific to JSR-223 engines lacking thread safety guarantees. Since the state is shared at the engine instance level rather than the script evaluation level, any application utilizing script-backed channels with high concurrency and non-thread-safe JSR-223 providers is susceptible to this state collision without requiring specific authentication, as the mechanism is triggered by the normal processing flow of the application."
}