It is a flaw in Spring Integration's DefaultJmsHeaderMapper that blindly copies all JMS user properties into MessageHeaders. A malicious producer can set properties named replyChannel, errorChannel, or json__TypeId__ and have them treated as internal routing or error handling headers. This allows the attacker to redirect messages to arbitrary channels or trigger unintended processing, potentially leading to message manipulation, denial of service, or leakage of routing information. The vulnerability is an input validation flaw where framework-significant names are not excluded before mapping.

The issue affects Spring Integration releases 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, 6.4.0 through 6.4.12, and all 5.5.21-earlier versions. All installations that expose a JMS inbound adapter consuming from a broker where attacker-controlled producers can write to the topic or queue are potentially affected.

The CVSS score of 5.4 indicates medium severity, and the EPSS score is not available, suggesting that exploitation risk is currently uncertain. It is not listed in CISA's KEV catalog, but the lack of a known exploit does not mitigate the possibility of abuse. The attacker only needs write access to the JMS destination, so the attack vector is application-level. The impact is limited to manipulation of message routing or triggering deserialization if json__TypeId__ is used. Administrators should treat this as a moderate risk until a patch is applied.