AIKIDO-2026-957944
spring-integration-core is vulnerable to Deserialization of Untrusted Data
63
Medium Risk
This Affects:
spring-integration-coreTL;DR
spring-integration-core JsonToObjectTransformer resolves the json__TypeId__ header with ClassUtils.forName and no type allow-list. When that header is mapped from an inbound transport such as AMQP or Kafka, a producer chooses the class that JSON is bound into. That can load unexpected types and deserialize untrusted payloads. The patch restricts type resolution to an allow-list.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and JsonToObjectTransformer consumes messages whose json__TypeId__ header comes from an external producer.
Background info
spring-integration-core is vulnerable to Deserialization of Untrusted Data in versions 0.0.1 - 7.0.5 and 7.1.0 - 7.1.0.
How to fix this
Upgrade the org.springframework.integration:spring-integration-core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant