CVE-2026-47880

Published September 3, 2026

CVSS 3.15.4

SeverityMedium

Known exploitedNo

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or json__TypeId__ which are copied verbatim into the Spring Integration MessageHeaders.
Spring Integration 7.1.0
Spring Integration 7.0.0 – 7.0.5
Spring Integration 6.5.0 – 6.5.10
Spring Integration 6.4.0 – 6.4.12
Spring Integration 5.5.21 and earlier

NVD references:

https://spring.io/security/cve-2026-47880

Primary source: NIST National Vulnerability Database

Stay Ahead of the Threat Landscape