org.springframework.integration:spring-integration-core 6.4.1

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.integration:spring-integration-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Exposure of Data Element to Wrong Session Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the `fluxTransform` when used with an asynchronous or reordering fluxFunction that emits raw payloads. An attacker can access another user's reply headers and cause reply mis-routing by sending concurrent requests on the same `FluxMessageChannel` subscription. How to fix Exposure of Data Element to Wrong Session? Upgrade `org.springframework.integration:spring-integration-core` to version 7.0.6, 7.1.1 or higher.	[,7.0.6)[7.1.0,7.1.1)
M Deserialization of Untrusted Data Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the `JsonToObjectTransformer`. An attacker can execute arbitrary code or instantiate unexpected classes by supplying a crafted `json__TypeId__` message header that is mapped from an external source, such as AMQP or Kafka. How to fix Deserialization of Untrusted Data? Upgrade `org.springframework.integration:spring-integration-core` to version 7.0.6, 7.1.1 or higher.	[,7.0.6)[7.1.0,7.1.1)
M Incorrect Default Permissions Affected versions of this package are vulnerable to Incorrect Default Permissions via the `PropertiesPersistingMetadataStore`. An attacker can access sensitive metadata, such as processed message keys, offsets, or idempotency markers, by reading the world-readable metadata file created in a shared temporary directory. How to fix Incorrect Default Permissions? Upgrade `org.springframework.integration:spring-integration-core` to version 7.0.6, 7.1.1 or higher.	[,7.0.6)[7.1.0,7.1.1)
H Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the `decodeNativeFormat`. An attacker can inject arbitrary entries into `MessageHeaders`, including sensitive control headers, by sending crafted raw byte payloads to components using default settings. This allows untrusted data to propagate into downstream internal components, potentially altering application behavior or accessing sensitive information. How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')? Upgrade `org.springframework.integration:spring-integration-core` to version 7.0.6, 7.1.1 or higher.	[,7.0.6)[7.1.0,7.1.1)

Vulnerability

Vulnerable Version

Exposure of Data Element to Wrong Session

Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the fluxTransform when used with an asynchronous or reordering fluxFunction that emits raw payloads. An attacker can access another user's reply headers and cause reply mis-routing by sending concurrent requests on the same FluxMessageChannel subscription.

How to fix Exposure of Data Element to Wrong Session?

Upgrade org.springframework.integration:spring-integration-core to version 7.0.6, 7.1.1 or higher.

[,7.0.6)[7.1.0,7.1.1)

Deserialization of Untrusted Data

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonToObjectTransformer. An attacker can execute arbitrary code or instantiate unexpected classes by supplying a crafted json__TypeId__ message header that is mapped from an external source, such as AMQP or Kafka.

How to fix Deserialization of Untrusted Data?

Upgrade org.springframework.integration:spring-integration-core to version 7.0.6, 7.1.1 or higher.

[,7.0.6)[7.1.0,7.1.1)

Incorrect Default Permissions

Affected versions of this package are vulnerable to Incorrect Default Permissions via the PropertiesPersistingMetadataStore. An attacker can access sensitive metadata, such as processed message keys, offsets, or idempotency markers, by reading the world-readable metadata file created in a shared temporary directory.

How to fix Incorrect Default Permissions?

Upgrade org.springframework.integration:spring-integration-core to version 7.0.6, 7.1.1 or higher.

[,7.0.6)[7.1.0,7.1.1)

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the decodeNativeFormat. An attacker can inject arbitrary entries into MessageHeaders, including sensitive control headers, by sending crafted raw byte payloads to components using default settings. This allows untrusted data to propagate into downstream internal components, potentially altering application behavior or accessing sensitive information.

How to fix Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')?

Upgrade org.springframework.integration:spring-integration-core to version 7.0.6, 7.1.1 or higher.

[,7.0.6)[7.1.0,7.1.1)

org.springframework.integration:spring-integration-core@6.4.1

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically