Spring Security Advisories

RSS feed

fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

HIGH | AUGUST 20, 2026 | CVE-2026-59324

Description

When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. One user's response payload is delivered to another user's reply channel—cross-request information disclosure and reply mis-routing.

Affected Spring Products and Versions

Spring Integration:

  • 7.1.0 - 7.1.0
  • 7.0.0 - 7.0.5
  • 6.5.0 - 6.5.10
  • 6.4.0 - 6.4.12
  • 5.5.21 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
7.1.0.1Enterprise Support Only
7.1.1OSS
7.0.5.1Enterprise Support Only
7.0.6OSS
6.5.11Enterprise Support Only
6.4.13Enterprise Support Only
5.5.22Enterprise Support Only

The argument for fluxTransform() must be as Function<? super Flux<Message<I>>, ? extends Publisher<Message<O>>> fluxFunction to make it working. In other word, even without upgrade to mitigate this CVE, there is just enough to change the provided function signature.

References

History

  • 2026-08-20: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all