Spring Security Advisories

RSS feed

Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution

MEDIUM | AUGUST 20, 2026 | CVE-2026-47864

Description

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. This is a classic unsafe Java deserialization flaw (CWE-502).

Affected Spring Products and Versions

Spring Integration:

  • 7.1.0 - 7.1.0
  • 7.0.0 - 7.0.5
  • 6.5.0 - 6.5.10
  • 6.4.0 - 6.4.12
  • 5.5.21 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
7.1.0.1Enterprise Support Only
7.1.1OSS
7.0.5.1Enterprise Support Only
7.0.6OSS
6.5.11Enterprise Support Only
6.4.13Enterprise Support Only
5.5.22Enterprise Support Only

No further mitigation steps are necessary.

Credit

The issue was identified and responsibly reported by:

  • Uwez Khan
  • Yu Bao from PayPal Cyber Security Team

References

History

  • 2026-08-20: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all