CyberRota Analysis
AI-GeneratedA vulnerability exists in Spring Integration where a single ScriptEngine instance is reused across concurrent message processing, leading to potential corruption of internal state in non-thread-safe JSR-223 engines like the Kotlin kts engine. This can result in unintended leakage of message payloads or headers between script evaluations, or trigger false exceptions. Organizations using affected versions of Spring Integration should prioritize remediation to mitigate risks associated with message integrity and application stability.
Original NVD Description
A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers bindings into another message's script evaluation or throwing spurious exceptions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Related CVEs
Other vulnerabilities affecting the same vendor(s)