🔐 CVE Alert

CVE-2026-47864

MEDIUM 6.4

Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

CVSS Score
6.4
EPSS Score
0.0%
EPSS Percentile
0th

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Vendor spring
Product spring integration
Ecosystems
Industries
TechnologyEnterprise
Published Aug 27, 2026
Stay Ahead of the Next One

Get instant alerts for spring spring integration

Be the first to know when new medium vulnerabilities affecting spring spring integration are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low

Affected Versions

Spring / Spring Integration
7.1.0 7.0.0 ≤ 7.0.5 6.5.0 ≤ 6.5.10 6.4.0 ≤ 6.4.12 0 ≤ 5.5.21

References

NVD ↗ CVE.org ↗ EPSS Data ↗
spring.io: https://spring.io/security/cve-2026-47864