CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-47864

SerializingHttpMessageConverter deserializes the body of incoming HTTP requests with a raw java.io.ObjectInputStream and no class filtering. Any request with Content-Type application/x-java-serialized-object whose body resolves to a Serializable type is read directly via readObject(). If an application using this converter on an inbound HTTP endpoint has any known Java deserialization "gadget" on its classpath, a remote, unauthenticated attacker can achieve arbitrary code execution. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Exploit prediction scoring system (EPSS) score

EPSS Score 0.034

EPSS Ranking 88.2%

CVSS Severity

CVSS v3 Score 6.4

References

https://spring.io/security/cve-2026-47864

Products affected by CVE-2026-47864

Vmware » Spring Integration » Version: 6.4.0

cpe:2.3:a:vmware:spring_integration:6.4.0
Vmware » Spring Integration » Version: 6.4.1

cpe:2.3:a:vmware:spring_integration:6.4.1
Vmware » Spring Integration » Version: 6.4.10

cpe:2.3:a:vmware:spring_integration:6.4.10
Vmware » Spring Integration » Version: 6.4.11

cpe:2.3:a:vmware:spring_integration:6.4.11
Vmware » Spring Integration » Version: 6.4.12

cpe:2.3:a:vmware:spring_integration:6.4.12
Vmware » Spring Integration » Version: 6.4.2

cpe:2.3:a:vmware:spring_integration:6.4.2
Vmware » Spring Integration » Version: 6.4.3

cpe:2.3:a:vmware:spring_integration:6.4.3
Vmware » Spring Integration » Version: 6.4.4

cpe:2.3:a:vmware:spring_integration:6.4.4
Vmware » Spring Integration » Version: 6.4.5

cpe:2.3:a:vmware:spring_integration:6.4.5
Vmware » Spring Integration » Version: 6.4.6

cpe:2.3:a:vmware:spring_integration:6.4.6
Vmware » Spring Integration » Version: 6.4.7

cpe:2.3:a:vmware:spring_integration:6.4.7
Vmware » Spring Integration » Version: 6.4.8

cpe:2.3:a:vmware:spring_integration:6.4.8
Vmware » Spring Integration » Version: 6.4.9

cpe:2.3:a:vmware:spring_integration:6.4.9
Vmware » Spring Integration » Version: 6.5.0

cpe:2.3:a:vmware:spring_integration:6.5.0
Vmware » Spring Integration » Version: 6.5.1

cpe:2.3:a:vmware:spring_integration:6.5.1
Vmware » Spring Integration » Version: 6.5.10

cpe:2.3:a:vmware:spring_integration:6.5.10
Vmware » Spring Integration » Version: 6.5.2

cpe:2.3:a:vmware:spring_integration:6.5.2
Vmware » Spring Integration » Version: 6.5.3

cpe:2.3:a:vmware:spring_integration:6.5.3
Vmware » Spring Integration » Version: 6.5.4

cpe:2.3:a:vmware:spring_integration:6.5.4
Vmware » Spring Integration » Version: 6.5.5

cpe:2.3:a:vmware:spring_integration:6.5.5
Vmware » Spring Integration » Version: 6.5.6

cpe:2.3:a:vmware:spring_integration:6.5.6
Vmware » Spring Integration » Version: 6.5.7

cpe:2.3:a:vmware:spring_integration:6.5.7
Vmware » Spring Integration » Version: 6.5.8

cpe:2.3:a:vmware:spring_integration:6.5.8
Vmware » Spring Integration » Version: 6.5.9

cpe:2.3:a:vmware:spring_integration:6.5.9
Vmware » Spring Integration » Version: 7.0.0

cpe:2.3:a:vmware:spring_integration:7.0.0
Vmware » Spring Integration » Version: 7.0.1

cpe:2.3:a:vmware:spring_integration:7.0.1
Vmware » Spring Integration » Version: 7.0.2

cpe:2.3:a:vmware:spring_integration:7.0.2
Vmware » Spring Integration » Version: 7.0.3

cpe:2.3:a:vmware:spring_integration:7.0.3
Vmware » Spring Integration » Version: 7.0.4

cpe:2.3:a:vmware:spring_integration:7.0.4
Vmware » Spring Integration » Version: 7.0.5

cpe:2.3:a:vmware:spring_integration:7.0.5

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-47864

Products

Pricing

Contact Us