The vulnerability lies in Spring Integration's JsonToObjectTransformer, which selects the deserialization target type from a message header named json__TypeId__ and resolves it to a Java class using ClassUtils.forName without enforcing an allow‑list. Consequently, an attacker can supply a header value that points to any class available on the application’s JVM, potentially triggering the deserialization of malicious payloads and allowing arbitrary code execution in the application’s context.

Affected versions are Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0. The vendor is Spring, and the product is Spring Integration. Any deployment that incorporates one of these releases and exposes the JsonToObjectTransformer to untrusted input is vulnerable.

The CVSS score of 6.3 classifies the issue as medium severity. EPSS is not available, and the vulnerability is not listed in the KEV catalog. Attackers can exploit the flaw via network or internal messaging channels by injecting a crafted json__TypeId__ header. No publicly known exploits are available, but the absence of an allow‑list means the condition is effectively satisfied whenever the header is supplied.