fluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunction

published 2026-08-27 2 mo ago modified 2026-09-01 2 mo ago also EUVD-2026-67204

cvss: 8.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Patch / fix

fixed in 1

vmware spring_integration 5.5.22, 6.4.13, 6.5.11, 7.0.5.1, 7.1.0.1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-59324 updated 2026-10-12 cvss 8.2

org.springframework.integration/spring-integration-core: Spring Integration: Information disclosure via cross-message header leakage

Red Hat Fuse 7 spring-integration-core
not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 mo ago (2026-08-28)

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.2	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected products

Spring Spring Integration

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

spring.io /security/cve-2026-59324
vendor-advisory

Sources

CVE List CVE-2026-59324
NVD CVE-2026-59324

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary