CVE-2026-47880

MediumCVSS 5.4/10Last modified Sep 10, 2026

Description

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Spring	Spring Integration	7.1.0; >= 7.0.0, <= 7.0.5; >= 6.5.0, <= 6.5.10; >= 6.4.0, <= 6.4.12; <= 5.5.21

References

https://spring.io/security/cve-2026-47880Vendor Advisory

Timeline

Published: Aug 27, 2026
Last modified: Sep 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-478817.5Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that CVE-2026-478828.3When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Sp CVE-2026-478836.1UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter CVE-2026-478849.8Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view r CVE-2026-478857.5The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework CVE-2026-478867.5Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack CVE-2026-478876.1A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vu CVE-2026-478887.5A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 CVE-2026-478897.5A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Frame CVE-2026-47899.8Kyverno, versions 1.16.0 and later, are vulnerable to SSRF due to unrestricted CEL HTTP functions.CVE-2026-478909.8Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Fram CVE-2026-478919.8A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit.