Description (CNA)
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Spring / Spring Integration | affected 7.1.0; affected 7.0.0 through 7.0.5; affected 6.5.0 through 6.5.10; affected 6.4.0 through 6.4.12; affected 0 through 5.5.21 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.