CyberRota Analysis
AI-GeneratedThe vulnerability affects Spring Integration versions 5.5.21 and earlier, as well as several 6.x and 7.x versions, where the use of .fluxTransform() with asynchronous fluxFunctions can lead to the unintended sharing of reply headers among concurrent requests on the same FluxMessageChannel subscription. This can result in exposure of sensitive information, such as replyChannel and security headers, potentially compromising application integrity and confidentiality. Organizations utilizing affected Spring Integration versions should prioritize remediation to mitigate the risk of data leakage and ensure secure message handling.
Original NVD Description
When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier
Related CVEs
Other vulnerabilities affecting the same vendor(s)