CVE-2026-59324

Katalog CVE

CVSS 8.2 · High EPSS 0,28%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada vmware spring integration. Skor CVSS 3.1 8.2 (High) menurut vmware.com.

Deskripsi (NVD)

When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

8.2 (High), sumber vmware.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://spring.io/security/cve-2026-59324 advisory vendor