CVE-2026-47856: Spring Integration RCE Vulnerability

CVE-2026-47856 Overview

CVE-2026-47856 is an unsafe deserialization vulnerability in Spring Integration's JSON to object conversion. The framework uses the json__TypeId__ message header to select the target type for deserialization. It then resolves that header value to a Java class using ClassUtils.forName without applying any type or package allow-list. An attacker able to influence inbound message headers can direct the converter to load unintended classes, expanding the attack surface for deserialization abuse. The issue affects multiple supported Spring Integration branches.

Critical Impact
Attackers with the ability to inject or control message headers can influence which class Spring Integration loads during JSON deserialization, potentially enabling object injection and downstream exploitation.

Affected Products

Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5, 6.5.0 - 6.5.10, 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier

Discovery Timeline

2026-08-27 - CVE-2026-47856 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47856

Vulnerability Analysis

Spring Integration provides JSON-to-object conversion for messages flowing through its channels. The converter inspects the json__TypeId__ header on an inbound message to determine the target Java type. It then passes that header value to ClassUtils.forName to resolve the class before deserializing the JSON payload into an instance of it.

The converter performs no type allow-list check and no package restriction. Any class visible to the application classloader can be selected as the deserialization target. An attacker who controls message headers, for example through an upstream broker, HTTP inbound adapter, or messaging endpoint, can point the converter at arbitrary classes. This is a classic unsafe deserialization pattern in which the type discriminator is attacker-controlled.

The vulnerability aligns with insecure deserialization and unsafe reflection weakness classes. Exploitation depends on the presence of dangerous classes on the classpath and the way downstream components consume the deserialized object.

Root Cause

The root cause is missing input validation on the json__TypeId__ header. The converter trusts the header value and resolves it directly through ClassUtils.forName. Without an allow-list of permitted types or packages, the framework cannot distinguish safe application types from gadget classes suitable for abuse.

Attack Vector

The vulnerability is exploitable over the network wherever Spring Integration accepts messages with client-influenced headers. An authenticated low-privilege attacker sends a message that sets json__TypeId__ to a chosen fully qualified class name and provides matching JSON content. The converter loads that class and deserializes the payload into it, altering application behavior based on the attacker's chosen type.

See the Spring Security Advisory CVE-2026-47856 for vendor guidance and version-specific fix details.

Detection Methods for CVE-2026-47856

Indicators of Compromise

Inbound messages carrying a json__TypeId__ header that references classes outside the application's expected domain model or DTO packages.
Application logs showing ClassUtils.forName resolution of unusual class names, or ClassNotFoundException bursts driven by header probing.
Unexpected instantiation of framework, JDK, or library classes during JSON message conversion in Spring Integration flows.

Detection Strategies

Instrument message channels and inbound adapters to log the value of json__TypeId__ and compare it against an allow-list of expected types.
Inspect broker, HTTP, and AMQP traffic feeding Spring Integration for header manipulation patterns targeting deserialization sinks.
Review dependency inventories for Spring Integration versions listed in the advisory and correlate with runtime telemetry.

Monitoring Recommendations

Alert on repeated deserialization failures or class resolution errors originating from Spring Integration converters.
Monitor for outbound network connections or process spawns that follow message conversion events on affected services.
Capture full message headers in application logs for services exposing Spring Integration endpoints to untrusted producers.

How to Mitigate CVE-2026-47856

Immediate Actions Required

Identify all services using Spring Integration and inventory versions against the affected ranges in the advisory.
Upgrade to the fixed Spring Integration release for your branch as published in the Spring Security Advisory CVE-2026-47856.
Restrict which producers can set message headers on channels that feed JSON-to-object converters.
Validate that upstream services and gateways strip or overwrite the json__TypeId__ header from untrusted sources.

Patch Information

Upgrade to the patched versions published by the Spring team for the 6.4.x, 6.5.x, 7.0.x, and 7.1.x branches. Users on the 5.5.x line, which is out of open-source support, should plan migration to a supported branch. Consult the Spring Security Advisory CVE-2026-47856 for exact fixed versions and remediation notes.

Workarounds

Configure the JSON converter with an explicit trusted packages or trusted types allow-list where the framework exposes such an option.
Remove or ignore the json__TypeId__ header at ingress using a header filter or transformer before messages reach the converter.
Pin deserialization to a fixed, application-defined type instead of relying on header-driven type selection.

bash

# Configuration example: strip the json__TypeId__ header at ingress
# using a Spring Integration header filter before JSON conversion
# <int:header-filter input-channel="inbound" output-channel="toJson"
#                    header-names="json__TypeId__"/>