CyberRota Analysis
AI-GeneratedThe vulnerability arises from the EmbeddedHeadersJsonMessageMapper in Spring Integration, which allows for the deserialization of untrusted JSON headers into a mutable map without proper sanitization. This could lead to potential injection attacks or manipulation of message headers, impacting the integrity and security of message processing. Organizations using affected versions of Spring Integration should prioritize remediation to mitigate risks associated with this vulnerability.
Original NVD Description
The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizing or filtering untrusted header names by default. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Related CVEs
Other vulnerabilities affecting the same vendor(s)