A race condition vulnerability in Spring Integration allows for cross-message header leakage, potentially exposing sensitive tenant or security data to unauthorized concurrent requests.

This is a race condition (CWE-362) occurring when using .fluxTransform() with asynchronous fluxFunctions. Concurrent requests on the same subscription cause reply headers to be overwritten by the most recently processed message, leading to header leakage.

With a CVSS score of 8.2, this vulnerability represents a significant risk to data confidentiality and integrity. The potential for tenant-specific or security headers to be leaked between concurrent requests can lead to unauthorized data access and logical failures in multi-tenant applications, potentially resulting in data compromise.

Immediate Action: Upgrade to Spring Integration version 7.0.6 or 7.1.1 to patch the race condition.

Proactive Monitoring: Review application logs for anomalous header behavior or unexpected response routing that may indicate exploitation of the race condition.

Compensating Controls: If upgrading is not immediately possible, consider restricting concurrent processing on affected FluxMessageChannel subscriptions to prevent race conditions from occurring.

Public Exploit Available: No

The severity of potential data leakage in multi-tenant environments necessitates a prompt upgrade to the patched versions. Organizations should test the fix in a staging environment to ensure compatibility before deploying the update to production systems.