CVE-2026-47864

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

• CWE-502

• https://spring.io/security/cve-2026-47864Vendor Advisory

Published

Aug 27, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47859RFC6587SyslogDeserializer, used by the Spring Integration sy…6.5
• CVE-2026-4786Mitgation of CVE-2026-4519 was incomplete. If the URL contai…7.1
• CVE-2026-47860An attacker who can publish to a queue consumed by an applic…6.5
• CVE-2026-47861An unauthenticated remote attacker who can send a single UDP…6.3
• CVE-2026-47862An attacker who can set the file_name header on a message re…5.4
• CVE-2026-47863In Reactor Core, applications that use the Flux.bufferTimeou…7.5
• CVE-2026-47865VMware Avi Load Balancer contains an authentication bypass v…9.8
• CVE-2026-47866VMware Avi Load Balancer contains an authorization bypass vu…8.3
• CVE-2026-47867VMware Avi Load Balancer contains a remote code execution vu…8.8
• CVE-2026-47868VMware Avi Load Balancer contains a local privilege escalati…7.8
• CVE-2026-47869VMware Avi Load Balancer contains a remote code execution vu…8.8
• CVE-2026-47870VMware Avi Load Balancer contains a privilege escalation vul…8.8