Spring Integration 5.5.x Release Notes

13 versions

Comprehensive release notes and changelog for Spring Integration 5.5.x, including security patches, bug fixes, and feature updates across all supported versions.

Aug 28, 2026

Latest: 5.5.33

16 Patched Vulnerabilities

VEX Statements

August 2026

5.5.33

Released Aug 28, 2026

4 More

Full Version:

5.5.20-spring-integration-5.5.33

Security Fixes

A fluxTransform() function emitting raw payloads can no longer copy reply headers such as replyChannel, errorChannel and correlationId from an unrelated in-flight request, because every element that is not already a Message is now rejected with an IllegalStateException and the function must build its own Message (high severity, CVE-2026-59324).
A remote peer can no longer inject headers such as replyChannel and routingSlip, because EmbeddedJsonHeadersMessageMapper now prunes decoded wire headers and by default embeds only id, timestamp and contentType rather than every header (medium severity, CVE-2026-59322).
A shared ScriptEngine that declares itself not thread-safe is no longer evaluated by AbstractScriptExecutor without a concurrency guard, so concurrent messages can no longer corrupt its internal state (medium severity, CVE-2026-59321).
An octet-counted frame's sender-declared length can no longer force an unbounded heap allocation before the frame body is received, because RFC6587SyslogDeserializer now bounds that length (medium severity, CVE-2026-47859).
An unauthenticated UDP packet can no longer make the adapter send a datagram to an attacker-selected host and port, because UnicastReceivingChannelAdapter now acknowledges only addresses matching its trustedAckAddresses patterns, which are empty until configured (medium severity, CVE-2026-47861).
Untrusted JSON type-id headers can no longer select an arbitrary deserialization target class, because JsonToObjectTransformer now resolves a header-supplied type only from a configurable set of trusted packages (medium severity, CVE-2026-47856).
User-defined JMS properties with framework-significant names are no longer copied into message headers by DefaultJmsHeaderMapper, which now maps an inbound property only when its name matches the configured patterns, contentType alone by default (medium severity, CVE-2026-47880).
PropertiesPersistingMetadataStore no longer creates its persisted metadata file and directory in the shared temp directory with umask-inherited permissions, so neither is readable by other local users (low severity, CVE-2026-59292).
SerializingHttpMessageConverter now reads Java request bodies through an AllowListDeserializingConverter, but for backward compatibility applies no class restriction until one is set, so reading requests from untrusted sources still requires configuring trusted patterns through setAllowedPatterns or addAllowedPatterns (medium severity, CVE-2026-47864).

Dependency Upgrades

Spring AMQP (NES) 2.4.17-spring-amqp-2.4.28
Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.28
Spring Framework (NES) 5.3.39-spring-framework-5.3.54
Spring Kafka (NES) 2.8.11-spring-kafka-2.8.22
Spring Retry (NES) 1.3.4-spring-retry-1.3.13
Spring Security (NES) 5.7.14-spring-security-5.7.26
Spring Web Services (NES) 3.1.8-spring-ws-3.1.19

June 2026

5.5.32

Released Jun 15, 2026

CVE-2026-40987

Full Version:

5.5.20-spring-integration-5.5.32

Security Fixes

Addressed a path-traversal vulnerability in the remote-file inbound synchronizer, where a malicious or compromised FTP/SFTP/SMB server could write attacker-controlled files outside the configured local directory; path validation is now centralized in FileUtils.newFileInDirectoryIfValid, which rejects .. segments and escaping absolute paths (CVE-2026-40987).

Dependency Upgrades

Spring AMQP (NES) 2.4.17-spring-amqp-2.4.27
Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.27
Spring Framework (NES) 5.3.39-spring-framework-5.3.52
Spring Kafka (NES) 2.8.11-spring-kafka-2.8.21
Spring Retry (NES) 1.3.4-spring-retry-1.3.12
Spring Security (NES) 5.7.14-spring-security-5.7.25
Spring Web Services (NES) 3.1.8-spring-ws-3.1.18

April 2026

5.5.31

Released Apr 28, 2026

Full Version:

5.5.20-spring-integration-5.5.31

Dependency Upgrades

Spring AMQP (NES) 2.4.17-spring-amqp-2.4.26
Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.26
Spring Framework (NES) 5.3.39-spring-framework-5.3.51
Spring Kafka (NES) 2.8.11-spring-kafka-2.8.20
Spring Retry (NES) 1.3.4-spring-retry-1.3.11
Spring Security (NES) 5.7.14-spring-security-5.7.24
Spring Web Services (NES) 3.1.8-spring-ws-3.1.17

March 2026

5.5.30

Released Mar 25, 2026

Full Version:

5.5.20-spring-integration-5.5.30

Dependency Upgrades

Spring AMQP (NES) 2.4.17-spring-amqp-2.4.25
Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.25
Spring Framework (NES) 5.3.39-spring-framework-5.3.50
Spring Kafka (NES) 2.8.11-spring-kafka-2.8.19
Spring Retry (NES) 1.3.4-spring-retry-1.3.10
Spring Security (NES) 5.7.14-spring-security-5.7.23
Spring Web Services (NES) 3.1.8-spring-ws-3.1.16

October 2025

5.5.29

Released Oct 23, 2025

CVE-2025-41254

Full Version:

5.5.20-spring-integration-5.5.29

Notes

The recent CVE-2025-41254 patch for Spring Framework (NES) 5.3.49 required an update to Spring Integration's websocket integration. This change updates the websocket integration with Spring Framework to register a client session with a STOMP CONNECT frame. See the following related GitHub issue for additional details.

Dependency Upgrades

Spring AMQP (NES) 2.4.17-spring-amqp-2.4.24
Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.24
Spring Framework (NES) 5.3.39-spring-framework-5.3.49
Spring Kafka (NES) 2.8.11-spring-kafka-2.8.18
Spring Security (NES) 5.7.14-spring-security-5.7.22
Spring Web Services (NES) 3.1.8-spring-ws-3.1.15

September 2025

5.5.28

Released Sep 30, 2025

Full Version:

5.5.20-spring-integration-5.5.28

Dependency Upgrades

Spring AMQP (NES) 2.4.17-spring-amqp-2.4.23
Spring Kafka (NES) 2.8.11-spring-kafka-2.8.17
Spring Retry (NES) 1.3.4-spring-retry-1.3.8

5.5.27

Released Sep 23, 2025

Full Version:

5.5.20-spring-integration-5.5.27

Dependency Upgrades

Spring AMQP (NES) 2.4.17-spring-amqp-2.4.22
Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.23
Spring Framework (NES) 5.3.39-spring-framework-5.3.48
Spring Kafka (NES) 2.8.11-spring-kafka-2.8.16
Spring Security (NES) 5.7.14-spring-security-5.7.21
Spring Web Services (NES) 3.1.8-spring-ws-3.1.14

August 2025

5.5.26

Released Aug 25, 2025

Full Version:

5.5.20-spring-integration-5.5.26

Dependency Upgrades

Spring AMQP (NES) 2.4.17-spring-amqp-2.4.21
Spring Data BOM (NES) 2021.2.18-spring-data-bom-2021.2.22
Spring Framework (NES) 5.3.39-spring-framework-5.3.47
Spring Kafka (NES) 2.8.11-spring-kafka-2.8.15
Spring Retry (NES) 1.3.4-spring-retry-1.3.8
Spring Security (NES) 5.7.14-spring-security-5.7.20
Spring Web Services (NES) 3.1.8-spring-ws-3.1.13

May 2025

5.5.25

Released May 20, 2025

Full Version:

5.5.20-spring-integration-5.5.25

Dependency Upgrades

Spring Framework (NES): 5.3.39-spring-framework-5.3.46
Spring AMQP (NES): 2.4.17-spring-amqp-2.4.20
Spring Data BOM (NES): 2021.2.18-spring-data-bom-2021.2.21
Spring Kafka (NES): 2.8.11-spring-kafka-2.8.14
Spring Retry (NES): 1.3.4-spring-retry-1.3.7
Spring Security (NES): 5.7.14-spring-security-5.7.19
Spring WS (NES): 3.1.8-spring-ws-3.1.12

April 2025

5.5.24

Released Apr 23, 2025

Full Version:

5.5.20-spring-integration-5.5.24

Dependency Upgrades

Spring Security (NES): 5.7.14-spring-security-5.7.18

March 2025

5.5.23

Released Mar 20, 2025

Full Version:

5.5.20-spring-integration-5.5.23

Dependency Upgrades

Spring Kafka (NES): 2.8.11-spring-kafka-2.8.13
Spring Security (NES): 5.7.14-spring-security-5.7.17

February 2025

5.5.22

Released Feb 24, 2025

Full Version:

5.5.20-spring-integration-5.5.22

Notes

Publish Spring Integration under the org.springframework.integration group ID instead of com.herodevs.nes.springframework.integration

Dependency Upgrades

Spring Framework (NES): 5.3.39-spring-framework-5.3.45
Spring AMQP (NES): 2.4.17-spring-amqp-2.4.19
Spring Data BOM (NES): 2021.2.18-spring-data-bom-2021.2.20
Spring Data Geode (NES): 2.7.18
Spring Kafka (NES): 2.8.11-spring-kafka-2.8.12
Spring Retry (NES): 1.3.4-spring-retry-1.3.6
Spring Security (NES): 5.7.14-spring-security-5.7.16
Spring Framework (NES): 5.3.39-spring-framework-5.3.45
Spring WS (NES): 3.1.8-spring-ws-3.1.10
Mongo driver: 4.6.1

November 2024

5.5.21

Released Nov 15, 2024

Full Version:

5.5.20-spring-integration-5.5.21

Notes

This release originates from the open‑source Spring Integration repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Integration build 5.5.20. Full Version: 5.5.20-spring-integration-5.5.21

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.

New releases published regularly — check back often for the latest security updates

$ cat features.txt

Security Patches
Regular updates to keep your applications secure
CVE Remediation
Rapid response to critical vulnerabilities
Expert Support
Direct access to our development team