CVE-2026-47864 Overview
CVE-2026-47864 is an insecure deserialization vulnerability in Spring Integration's SerializingHttpMessageConverter. The converter reads HTTP request bodies using a raw java.io.ObjectInputStream without any class filtering. Any inbound request carrying Content-Type: application/x-java-serialized-object whose body resolves to a Serializable type is processed directly through readObject(). When a known Java deserialization gadget exists on the application classpath, a remote attacker can achieve arbitrary code execution. The flaw affects multiple Spring Integration release lines including 7.1.0, 7.0.0–7.0.5, 6.5.0–6.5.10, 6.4.0–6.4.12, and 5.5.21 and earlier.
Critical Impact
Remote attackers who can reach an HTTP endpoint using SerializingHttpMessageConverter may execute arbitrary code when a deserialization gadget is present on the classpath.
Affected Products
- Spring Integration 7.1.0
- Spring Integration 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12
- Spring Integration 5.5.21 and earlier
Discovery Timeline
- 2026-08-27 - CVE-2026-47864 published to the National Vulnerability Database
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-47864
Vulnerability Analysis
Spring Integration exposes an HTTP inbound gateway that can accept serialized Java objects. The SerializingHttpMessageConverter handles requests with the application/x-java-serialized-object media type. During request processing, the converter constructs a java.io.ObjectInputStream over the HTTP request body and invokes readObject() without applying an ObjectInputFilter or restricting acceptable classes. This behavior corresponds to insecure deserialization of untrusted data.
An unauthenticated attacker who can reach the vulnerable endpoint sends a crafted binary payload as the HTTP body. If the target application classpath contains a gadget chain from a library such as Commons Collections, Spring itself, or another exploitable dependency, deserialization triggers arbitrary method invocations that lead to command execution.
Root Cause
The root cause is the absence of class filtering during Java object deserialization. ObjectInputStream.readObject() reconstructs any Serializable type reachable on the classpath. Without an allow-list or ObjectInputFilter, the converter treats attacker-controlled bytes as trusted object graphs. This is a classic Insecure Deserialization weakness aligned with CWE-502.
Attack Vector
Exploitation requires network reachability to an HTTP endpoint that uses SerializingHttpMessageConverter on inbound traffic. The attacker submits an HTTP POST with Content-Type: application/x-java-serialized-object and a serialized gadget payload in the body. Successful exploitation depends on the presence of a known gadget chain in the target application's dependencies. Refer to the Spring Framework CVE-2026-47864 Advisory for detailed vendor guidance.
Detection Methods for CVE-2026-47864
Indicators of Compromise
- Inbound HTTP requests carrying the Content-Type: application/x-java-serialized-object header, particularly from untrusted sources.
- Java processes spawning unexpected child processes such as shells, curl, wget, or scripting interpreters shortly after HTTP requests.
- Stack traces referencing ObjectInputStream.readObject, SerializingHttpMessageConverter, or known gadget classes in application logs.
Detection Strategies
- Inspect web access logs and reverse proxy logs for POST requests using the application/x-java-serialized-object media type against Spring Integration endpoints.
- Monitor JVM behavior for Runtime.exec, ProcessBuilder, or reflective invocations originating from HTTP request-handling threads.
- Correlate deserialization exceptions with subsequent process creation or outbound network connections from application servers.
Monitoring Recommendations
- Enable verbose logging on Spring Integration HTTP inbound adapters and forward logs to a centralized analytics platform.
- Establish baselines for legitimate application/x-java-serialized-object traffic and alert on deviations.
- Track child process creation from Java application accounts on hosts running Spring Integration workloads.
How to Mitigate CVE-2026-47864
Immediate Actions Required
- Identify all applications using SerializingHttpMessageConverter on inbound HTTP endpoints and inventory affected Spring Integration versions.
- Upgrade Spring Integration to a fixed release as documented in the Spring Framework CVE-2026-47864 Advisory.
- Restrict network access to affected endpoints using firewalls, reverse proxies, or authentication controls until patches are deployed.
Patch Information
Apply the fixed Spring Integration releases published by the vendor. Consult the Spring Framework CVE-2026-47864 Advisory for exact patched version numbers corresponding to each affected release line.
Workarounds
- Remove SerializingHttpMessageConverter from HTTP inbound gateway configurations where Java serialized objects are not required.
- Block requests with Content-Type: application/x-java-serialized-object at a reverse proxy or web application firewall.
- Configure a JVM-wide ObjectInputFilter via jdk.serialFilter to restrict deserializable classes to a strict allow-list.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
