The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. As a result, any transport component using EmbeddedHeadersJsonMessageMapper with default settings—such as ZeroMqChannel when receiving raw socket bytes—allows external network peers to supply arbitrary MessageHeaders entries (including sensitive control headers like replyChannel, errorChannel, routingSlip, and json__TypeId__). These injected headers propagate directly into downstream internal components, such as BeanFactoryChannelResolver, through standard handler/error-handler pipelines.