A flaw in the SerializingHttpMessageConverter causes it to deserialize incoming HTTP request bodies with a raw java.io.ObjectInputStream without applying any class‑level filtering. By sending a request whose Content‑Type is application/x-java-serialized-object and whose payload resolves to a Serializable type on the server’s classpath, an attacker can force the server to execute a deserialization gadget chain that leads to arbitrary code execution. The vulnerability is classified as arbitrary code execution via insecure deserialization, a type of injection flaw that allows malicious input to be interpreted as executable code.

The issue affects Spring Integration implementations. All releases from Spring Integration 5.5.21 and earlier, 6.4.0 through 6.4.12, 6.5.0 through 6.5.10, 7.0.0 through 7.0.5, and 7.1.0 are vulnerable. Applications that depend on these versions and expose HTTP endpoints powered by the affected converter are at risk.

The CVSS score of 6.4 indicates a moderate to high severity for remote exploitation. EPSS score is 3%, indicating a low but non-zero exploitation probability, but the lack of authentication and the need only for a specially crafted HTTP request means the prospect of exploitation is high in environments where the described endpoint is reachable. The vulnerability is not yet listed in CISA’s KEV catalog, so public exploit code may not yet exist, but the potential for an unauthenticated attacker to achieve full code execution remains significant, especially in open or poorly monitored interfaces.