Messaging

Spring Integration7.1.0.1

Supports the well-known Enterprise Integration Patterns through lightweight messaging and declarative adapters.

Reference Doc-API Doc

Changelog

🐞 Bug Fixes

  • CVE-2026-59324: Fix cross-message header leakage in fluxTransform() under concurrency
  • CVE-2026-59321: Fix AbstractScriptExecutor for not thread-safe engines
  • CVE-2026-59322: Change EmbeddedHeadersJsonMessageMapper default to no headers
  • CVE-2026-59311: Prevent zip transformers from writing temp files to symlink
  • CVE-2026-59311: Prevent zip transformers from writing temp files to symlink
  • CVE-2026-59307: JdbcMessageStore: new mapper on setBeanClassLoader
  • CVE-2026-59293: Set SMB default version to SMB202
  • CVE-2026-59274: Add size constraint options to UnzipTransformer
  • CVE-2026-47864: Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
  • CVE-2026-47859: Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote DoS
  • CVE-2026-47862: ZipTransformer uses file_name header to build workDirectory path without sanitization
  • CVE-2026-47861: UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when acknowledge=false
  • CVE-2026-47856: JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class without an allow-list

🔨 Dependency Upgrades

  • Upgrade spring-framework to 7.0.8.1
  • Upgrade spring-security to 7.1.0.1
  • Upgrade spring-kafka to 4.1.0.1
  • Upgrade spring-graphql to 2.0.4.1
  • Upgrade spring-data-bom to 2026.0.0.1
  • Upgrade spring-amqp to 4.1.0.1
  • Upgrade reactor to 2025.0.6.1
  • Upgrade micrometer to 1.17.0.1
  • Upgrade micrometer-tracing to 1.7.0.1

❤️ Contributors

Thank you to all the contributors who worked on this release:

@cppwfs

Get Started with Tanzu Spring today
Contact Us