← CVE Intelligence

CVE-2026-59307

Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference PUBLISHED

Description (CNA)

An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12

Affected (CNA)

Vendor / productVersions
Spring / Spring Integrationaffected 7.1.0; affected 7.0.0 through 7.0.5; affected 6.5.0 through 6.5.10; affected 6.4.0 through 6.4.12

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.