A newly published flaw, CVE-2026-47856, affects how Spring Integration's JSON-to-object conversion picks a deserialization target class — it trusts a client-supplied header with no allow-list restricting which classes can be instantiated. That design leaves applications open to unsafe deserialization if attacker-controlled data reaches the affected component. The issue spans versions from the 5.5.x line through 7.1.0, so teams running Spring Integration should check for an update.
// source: nvd.nist.gov ↗