CVE-2026-47880: Spring Integration JMS Information Disclosure

CVE-2026-47880 Overview

CVE-2026-47880 affects Spring Integration's JMS inbound components. A producer who can publish to a JMS destination consumed by a Spring Integration JMS inbound component can inject controlled String JMS properties. Specifically, properties named replyChannel, errorChannel, or json__TypeId__ are copied verbatim into the Spring Integration MessageHeaders. Downstream components then treat these attacker-controlled headers as trusted routing and type metadata. This allows the producer to influence message routing, error handling, and JSON deserialization type resolution within the consumer application.

Critical Impact
An authenticated JMS producer can manipulate Spring Integration routing headers and JSON type identifiers, redirecting replies and errors or influencing deserialization behavior in the consuming application.

Affected Products

Spring Integration 7.1.0
Spring Integration 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12
Spring Integration 5.5.21 and earlier

Discovery Timeline

2026-08-27 - CVE-2026-47880 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47880

Vulnerability Analysis

Spring Integration's JMS inbound adapters and gateways convert incoming javax.jms.Message or jakarta.jms.Message properties into Spring Integration MessageHeaders. The conversion does not exclude framework-reserved header names. As a result, an upstream producer can set String JMS properties that override headers the framework treats as internal control metadata.

The replyChannel and errorChannel headers instruct Spring Integration where to send responses and error signals. When a remote producer sets these values, the consumer routes messages to channels selected by the attacker. The json__TypeId__ header controls target class resolution for JSON payload deserialization in Jackson-based converters. Injecting this header lets a producer steer deserialization toward classes chosen by the attacker within the consumer's classpath.

Root Cause

The root cause is missing header name filtering in the JMS-to-MessageHeaders mapping logic. Framework-reserved header names are not distinguished from arbitrary user headers when JMS properties are copied into the Spring Integration message.

Attack Vector

Exploitation requires authenticated publish access to a JMS destination consumed by a vulnerable Spring Integration inbound component. The producer sets String JMS properties matching the reserved header names before publishing. The consumer accepts these properties as trusted MessageHeaders, altering routing, error dispatch, or type-driven deserialization. Refer to the Spring Security Advisory CVE-2026-47880 for authoritative technical detail.

Detection Methods for CVE-2026-47880

Indicators of Compromise

Inbound JMS messages containing String properties named replyChannel, errorChannel, or json__TypeId__ originating from producers that should not control routing.
Spring Integration logs showing unexpected reply or error channel names not present in the application configuration.
Jackson deserialization events resolving to classes outside the expected domain model.

Detection Strategies

Enable DEBUG logging on org.springframework.integration and inspect header maps on inbound JMS messages for reserved header names set by producers.
Instrument the JMS header mapper to record any incoming property whose name matches a Spring Integration reserved header.
Review broker audit logs for producers publishing messages that include json__TypeId__ values referencing unexpected fully qualified class names.

Monitoring Recommendations

Alert on deserialization of unexpected types by Jackson converters within Spring Integration flows.
Track channel resolution failures and messages routed to dynamically named channels not defined at startup.
Correlate JMS producer identities with headers set on messages consumed by Spring Integration endpoints.

How to Mitigate CVE-2026-47880

Immediate Actions Required

Upgrade Spring Integration to a fixed release line as identified in the Spring Security Advisory CVE-2026-47880.
Restrict JMS publish permissions so only trusted producers can send to destinations consumed by Spring Integration inbound components.
Audit application code for reliance on json__TypeId__ header-driven polymorphic deserialization and constrain accepted types.

Patch Information

Refer to the Spring Security Advisory CVE-2026-47880 for the fixed versions in the 6.4.x, 6.5.x, 7.0.x, and 7.1.x branches. Users on Spring Integration 5.5.21 and earlier should plan an upgrade to a supported branch, as the 5.x line no longer receives open-source maintenance.

Workarounds

Configure the JMS inbound HeaderMapper with an explicit allowlist that excludes replyChannel, errorChannel, and json__TypeId__.
Disable default type-ID-based Jackson deserialization and use a fixed, code-defined type resolver instead.
Enforce broker-side authorization so untrusted principals cannot publish to destinations consumed by Spring Integration flows.

bash

# Example: restrict inbound JMS header mapping to a safe allowlist
# In Spring Integration Java configuration for the JMS inbound adapter
# jmsHeaderMapper.setInboundHeaderNames(new String[] { "correlationId", "timestamp", "contentType" });