HeroDevs
Visit NES for Spring Home Page

Spring Integration 6.3.x Release Notes

5 versions

Comprehensive release notes and changelog for Spring Integration 6.3.x, including security patches, bug fixes, and feature updates across all supported versions.

Aug 28, 2026
Latest: 6.3.16
70 Patched Vulnerabilities
VEX Statements

August 2026

6.3.16

Released Aug 28, 2026
CVE-2026-59324
CVE-2026-59322
CVE-2026-59321
CVE-2026-47862
CVE-2026-47859
8 More
Full Version: 
6.3.11-spring-integration-6.3.16

Security Fixes

  • A fluxTransform() function emitting raw payloads can no longer copy reply headers such as replyChannel, errorChannel and correlationId from an unrelated in-flight request, because every element that is not already a Message is now rejected with an IllegalStateException and the function must build its own Message (high severity, CVE-2026-59324).
  • A remote peer can no longer inject headers such as replyChannel and routingSlip, because EmbeddedJsonHeadersMessageMapper now prunes decoded wire headers and by default embeds only id, timestamp and contentType rather than every header (medium severity, CVE-2026-59322).
  • A shared ScriptEngine that declares itself not thread-safe is no longer evaluated by AbstractScriptExecutor without a concurrency guard, so concurrent messages can no longer corrupt its internal state (medium severity, CVE-2026-59321).
  • An attacker-controlled file_name header or a symlinked work directory can no longer cause ZipTransformer to write archive data outside the configured work directory (medium severity, CVE-2026-47862).
  • An octet-counted frame's sender-declared length can no longer force an unbounded heap allocation before the frame body is received, because RFC6587SyslogDeserializer now bounds that length (medium severity, CVE-2026-47859).
  • An unauthenticated UDP packet can no longer make the adapter send a datagram to an attacker-selected host and port, because UnicastReceivingChannelAdapter now acknowledges only addresses matching its trustedAckAddresses patterns, which are empty until configured (medium severity, CVE-2026-47861).
  • An untrusted ZIP archive can no longer expand without limit in UnZipTransformer, which now enforces configurable caps on total uncompressed size (100 MB), entry count (1000) and compression ratio (100) (medium severity, CVE-2026-59274).
  • Untrusted JSON type-id headers can no longer select an arbitrary deserialization target class, because JsonToObjectTransformer now resolves a header-supplied type only from a configurable set of trusted packages (medium severity, CVE-2026-47856).
  • User-defined JMS properties with framework-significant names are no longer copied into message headers by DefaultJmsHeaderMapper, which now maps an inbound property only when its name matches the configured patterns, contentType alone by default (medium severity, CVE-2026-47880).
  • AbstractZipTransformer no longer accepts its default work directory without a symlink check, so a local user who pre-creates that path as a symlink can no longer redirect transformer output (medium severity, CVE-2026-59311).
  • PropertiesPersistingMetadataStore no longer creates its persisted metadata file and directory in the shared temp directory with umask-inherited permissions, so neither is readable by other local users (low severity, CVE-2026-59292).
  • SerializingHttpMessageConverter now reads Java request bodies through an AllowListDeserializingConverter, but for backward compatibility applies no class restriction until one is set, so reading requests from untrusted sources still requires configuring trusted patterns through setAllowedPatterns or addAllowedPatterns (medium severity, CVE-2026-47864).
  • SmbConfig no longer defaults smbMinVersion to DialectVersion.SMB1, so the client can no longer negotiate down to a dialect with no mandatory signing or encryption (medium severity, CVE-2026-59293).

Dependency Upgrades

  • Spring AMQP (NES) 3.1.12-spring-amqp-3.1.20
  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.18
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.30
  • Spring GraphQL (NES) 1.3.7-spring-graphql-1.3.12
  • Spring Kafka (NES) 3.2.10-spring-kafka-3.2.15
  • Spring Retry (NES) 2.0.13-spring-retry-2.0.15
  • Spring Security (NES) 6.3.10-spring-security-6.3.15
  • Spring Web Services (NES) 4.0.17-spring-ws-4.0.22

June 2026

6.3.15

Released Jun 15, 2026
CVE-2026-40987
Full Version: 
6.3.11-spring-integration-6.3.15

Security Fixes

  • Addressed a path-traversal vulnerability in the remote-file inbound synchronizer, where a malicious or compromised FTP/SFTP/SMB server could write attacker-controlled files outside the configured local directory; path validation is now centralized in FileUtils.newFileInDirectoryIfValid, which rejects .. segments and escaping absolute paths (CVE-2026-40987).

Dependency Upgrades

  • Spring AMQP (NES) 3.1.12-spring-amqp-3.1.19
  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.17
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.28
  • Spring Kafka (NES) 3.2.10-spring-kafka-3.2.14
  • Spring Security (NES) 6.3.10-spring-security-6.3.14

April 2026

6.3.14

Released Apr 28, 2026
Full Version: 
6.3.11-spring-integration-6.3.14

Dependency Upgrades

  • Spring AMQP (NES) 3.1.12-spring-amqp-3.1.18
  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.16
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.27
  • Spring Kafka (NES) 3.2.10-spring-kafka-3.2.13
  • Spring Security (NES) 6.3.10-spring-security-6.3.13

March 2026

6.3.13

Released Mar 25, 2026
Full Version: 
6.3.11-spring-integration-6.3.13

Dependency Upgrades

  • Spring AMQP (NES) 3.1.12-spring-amqp-3.1.17
  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.15
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.26
  • Spring Kafka (NES) 3.2.10-spring-kafka-3.2.12
  • Spring Security (NES) 6.3.10-spring-security-6.3.12

December 2025

6.3.12

Released Dec 10, 2025
CVE-2025-41254
Full Version: 
6.3.11-spring-integration-6.3.12

Notes

  • This release originates from the open‑source Spring Integration repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds.
  • The recent CVE-2025-41254 patch for Spring Framework (NES) 6.1.25 required an update to Spring Integration's websocket integration. This change updates the websocket integration with Spring Framework to register a client session with a STOMP CONNECT frame. See the following related GitHub issue for additional details.

Dependency Upgrades

  • Spring AMQP (NES) 3.1.12-spring-amqp-3.1.16
  • Spring Data BOM (NES) 2024.0.13-spring-data-bom-2024.0.14
  • Spring Framework (NES) 6.1.21-spring-framework-6.1.25
  • Spring Kafka (NES) 3.2.10-spring-kafka-3.2.11
  • Spring Security (NES) 6.3.10-spring-security-6.3.11Full Version: 6.3.11-spring-integration-6.3.12

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.