The EmbeddedHeadersJsonMessageMapper in Spring Integration defaults to a permissive header parsing mode. When raw byte payloads are decoded, the mapper deserializes embedded JSON headers into an unfiltered plain map and constructs a GenericMessage with mutable headers. Because untrusted header names are not sanitized or restricted, a remote party can inject arbitrary headers into the message. This can lead to unauthorized manipulation of message metadata, potentially affecting downstream processing and the behavior of the application that consumes the message.

Spring Integration versions 5.5.21 and earlier, 6.4.0‑6.4.12, 6.5.0‑6.5.10, 7.0.0‑7.0.5, and 7.1.0 are affected. Systems using these versions and the default EmbeddedHeadersJsonMessageMapper configuration are susceptible to the flaw.

The CVSS score of 6.3 indicates moderate severity; EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that mass exploitation may be low. Based on the description, the likely attack vector is the delivery of a crafted message over the network that includes malicious JSON header data. An attacker exploiting this flaw can insert arbitrary headers and manipulate how the message is interpreted by the application, potentially leading to escalation of privileges or denial‑of‑service conditions if header handling is critical to the workflow.