A flaw in Spring Integration allows an operator who calls JdbcMessageStore.addAllowedPatterns(...) to set a deserialization allow‑list to be silently bypassed when the store is managed as a Spring bean. The issue occurs because the setBeanClassLoader operation replaces the deserializer in use, while the underlying Jackson mapper retains a stale reference, leaving the object deserialization unchecked. The result is that an attacker who can control the allowed patterns can supply malicious data that will be deserialized and executed with the application’s privileges.

Spring Integration versions 7.1.0, 7.0.0 through 7.0.5, 6.5.0 through 6.5.10, and 6.4.0 through 6.4.12 are affected. The vulnerability is present in the JdbcMessageStore component of these releases.

The vulnerability carries a CVSS 8.0 score and is not listed in the CISA KEV catalog. EPSS data is not available. The likely attack vector requires an authenticated operator who can invoke addAllowedPatterns to manipulate the allow‑list; once a malicious pattern is inserted, the stale deserializer permits arbitrary code execution during deserialization.