CVE-2026-59321

A single ScriptEngine instance is reused for every message on a script-backed channel. For JSR-223 engines that report THREADING=null (not thread-safe, e.g. the Kotlin kts engine), concurrent message processing can corrupt engine-internal state, potentially leaking one message's payload/headers bindings into another message's script evaluation or throwing spurious exceptions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

• CWE-362

• https://spring.io/security/cve-2026-59321Vendor Advisory

Published

Aug 27, 2026

Last Modified

Aug 31, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59315The Spring Cloud Config Monitor is susceptible to Denial of …5.3
• CVE-2026-59316Spring Authorization Server's default consent page renders u…8.2
• CVE-2026-59317DeadLetterPublishingRecovererFactory reads the retry_topic-o…6.5
• CVE-2026-59318In Spring AI's tool calling support, the per-request tool li…9.8
• CVE-2026-59319RedisChatMemoryRepository.findByMetadata() builds RediSearch…4.3
• CVE-2026-59320When a container-level ErrorHandler is configured (the mitig…6.5
• CVE-2026-59322The EmbeddedHeadersJsonMessageMapper defaults to an overly p…6.3
• CVE-2026-59323An application using Micrometer Tracing with W3C baggage pro…5.3
• CVE-2026-59324When an IntegrationFlow uses .fluxTransform() with an asynch…8.2
• CVE-2026-59326The Spring Boot language server logs the raw value of the ht…3.3
• CVE-2026-59327Spring Tools for Eclipse stores the Spring Boot DevTools rem…4.4
• CVE-2026-59328Spring Tools for Eclipse renders Spring Boot starter wizard …4.2