← Back

CVE-2026-47880

nvd nist
Published: Aug 27, 2026Modified: Sep 10, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.5
Source: security@vmware.com (Secondary)

Description

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Affected (5)

Vmware
1 product
Spring Integration
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Vmware
Spring Integration
version < 5.5.22
Spring Integration
6.4.0 ≤ version < 6.4.13
Spring Integration
6.5.0 ≤ version < 6.5.11
Spring Integration
7.0.0 ≤ version < 7.0.5.1
Spring Integration
7.1.0 ≤ version < 7.1.0.1

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.