CVE-2026-59324

EUVD-2026-67204

27.08.2026, 20:17

When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream.
Spring Integration 7.1.0
Spring Integration 7.0.0 - 7.0.5
Spring Integration 6.5.0 - 6.5.10
Spring Integration 6.4.0 - 6.4.12
Spring Integration 5.5.21 and earlier

Race Condition

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.2 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 18.55%

Affected Products (NVD)

Vendor	Product	Version
vmware	spring_integration	𝑥 < 5.5.22
vmware	spring_integration	6.4.0 ≤ 𝑥 < 6.4.13
vmware	spring_integration	6.5.0 ≤ 𝑥 < 6.5.11
vmware	spring_integration	7.0.0 ≤ 𝑥 < 7.0.5.1
vmware	spring_integration	7.1.0 ≤ 𝑥 < 7.1.0.1

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

References

https://spring.io/security/cve-2026-59324