CVE-2026-47856 Spring CVE debrief

Who should care

Security teams and developers using Spring Integration should be aware of this vulnerability and take necessary actions to protect their applications. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. The vulnerability's CVSS score of 6.3 indicates a medium-priority defensive action is required due to the potential for deserialization attacks. The CVE Program and NVD provide official records and assessments, which should be consulted for further information. Affected product deployments should be identified in managed environments and assigned an owner for follow-up. The json__TypeId__ header usage should be restricted to prevent potential deserialization attacks. Monitoring and detection capabilities should be reviewed to ensure they can identify potential exploitation attempts. Asset inventory and vulnerability management processes should be updated to account for this vulnerability. Rollback and change window procedures should be reviewed to ensure they can accommodate emergency patches. Source tracking and incident response plans should also be updated to address this vulnerability. Compensating controls, such as input validation and output encoding, should be implemented for exposed systems while remediation is scheduled and verified. The debrief and technical summary provide additional context on the vulnerability and its impact. Evidence notes and recommended actions are also provided to support defensive efforts. The CVE-2026-47856 record indicates that Spring Integration's JSON to object conversion is vulnerable to deserialization attacks via the json__TypeId__ header. Affected versions include Spring Integration 5.5.21 and earlier, 6.4.0 - 6.4.12, 6

Technical summary

CVE-2026-47856 is a deserialization vulnerability in Spring Integration's JSON to object conversion. The vulnerability uses the json__TypeId__ header to choose the deserialization target type and resolves that header value to a class with ClassUtils.forName without a type/package allow-list. This allows for potential deserialization attacks. Affected versions include Spring Integration 5.5.21 and earlier, 6.4.0 - 6.4.12, 6.5.0 - 6.5.10, 7.0.0 - 7.0.5, and 7.1.0.

Defensive priority

Medium-priority defensive actions are required due to the CVSS score of 6.3 and the potential for deserialization attacks.

Recommended defensive actions

• Inventory and verify affected Spring Integration versions
• Apply vendor patches or updates
• Implement compensating controls for deserialization
• Monitor for suspicious activity
• Restrict json__TypeId__ header usage

Evidence notes

The CVE-2026-47856 record indicates that Spring Integration's JSON to object conversion is vulnerable to deserialization attacks via the json__TypeId__ header. Affected versions include Spring Integration 5.5.21 and earlier, 6.4.0 - 6.4.12, 6.5.0 - 6.5.10, 7.0.0 - 7.0.5, and 7.1.0. The CVE Program and NVD provide official records and assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.