An operator who calls JdbcMessageStore.addAllowedPatterns(…) to restrict deserialization receives no protection at all when the store is a Spring-managed bean.
Spring Integration 7.1.0
Spring Integration 7.0.0 – 7.0.5
Spring Integration 6.5.0 – 6.5.10
Spring Integration 6.4.0 – 6.4.12
HIGH
Vulnerability intelligence
CVE-2026-59307
CVSS 3.18
SeverityHigh
Known exploitedNo
NVD references:
Primary source: NIST National Vulnerability Database