v4.7.0

Open Integration Engine 4.7.0 release notes

Highlights

• Stronger XML and database security. Closes SQL injection and XML external entity vulnerabilities in the Database Connector API, XML batch processing, and XSLT transformer input. Additional hardening protects custom metadata searches and strict HL7 v2 XML parsing.
• More control over HTTP connections. HTTP Sender can bind outgoing connections to a selected local address. HTTP Listener supports a configurable maximum request-header size. Sender change, listener change.
• Recent message-search filters. Quickly reuse up to ten recent filters per channel. History stays in Administrator process memory rather than being written to local preferences, where search terms could expose sensitive data. Feature, memory-only storage.
• Batch submission with every message ID. The new POST /api/channels/{channelId}/batchMessagesWithObj endpoint returns the IDs of all messages produced by a successful batch submission. It respects the channel's Process Batch setting; channels without batch processing return a single ID. API change.
• JDBC drivers in custom resources work again. On Java 9 and later, a JDBC driver supplied through a library resource could not be loaded. The resource's isolated classloader could not see Java platform classes such as java.sql.Driver. Database Reader and Database Writer connectors not using JavaScript failed to deploy with NoClassDefFoundError: java/sql/Driver, and scripts using DatabaseConnectionFactory, including Database Reader and Writer connectors in JavaScript mode, failed when opening a connection. This blocked using a driver version other than the one shipped with the server, or different driver versions in different channels. Isolated resources can now see Java platform classes while remaining isolated from the engine's own libraries. Originally reported in Mirth Connect discussion #5079. Thanks to @paul-hristea. Fix.
• Reliability improvements. Fixes Oracle JDBC batch inserts, duplicate server-plugin lifecycle calls, and CLI hangs on authentication or connection failures.
• Modernized source builds and containers. Gradle replaces Ant, dependency checksums are verified, and an in-repository Docker build supports startup configuration through environment variables and mounted secrets, including database and JVM settings. Automated smoke tests cover five database types. Container support.

Contributors

Thanks to everyone who contributed to 4.7.0: @e210, @ggiannola, @jbeckers, @jonbartels, @kerfern, @kpalang, @mgaffigan, @miguel-figueiredoPT, @NicoPiel, @pacmano1, @paul-hristea, @sbraconnier and @tonygermano. Your ongoing work is sincerely appreciated.

New Contributors

Special thanks to our new contributors for joining the effort.

• @jbeckers made their first contribution in #333
• @ggiannola made their first contribution in #397
• @e210 made their first contribution in #351
• @kerfern made their first contribution in #400
• @miguel-figueiredoPT made their first contribution in #231
• @paul-hristea made their first contribution in #340

Security: CVEs addressed

4.7.0 contains fixes for 3 CVEs in shared engine code and dependency upgrades addressing 45 additional CVEs in bundled runtime components. One further CVE is fixed in test-only JUnit. These counts describe verified fixes and affected/fixed component versions; they do not imply that every upstream vulnerability was exploitable in an OIE deployment.

Engine fixes

CVE	Fix
CVE-2026-82583	SQL injection in Database Connector API table metadata discovery.
CVE-2026-78224	External-entity expansion in XSLT transformer message input.
CVE-2026-82578	External-entity expansion in XPath-based XML batch processing.

The public advisory names NextGen/Mirth Connect; OIE includes corresponding fixes in the shared code. The CVE records list Mirth Connect 4.7.1 and earlier as affected. Those are Mirth version numbers, and OIE 4.7.0 includes these fixes. CISA advisory.

Dependency fixes

Component	4.6.0 → 4.7.0	CVEs addressed
Jackson Core	2.14.3 → 2.18.8	CVE-2025-52999
Microsoft SQL Server JDBC	8.4.1.jre8 → 10.2.4.jre11	CVE-2025-59250
Jakarta Mail	1.6.7 → 1.6.8	CVE-2025-7962
Apache Commons Configuration	2.13.0 → 2.15.0	CVE-2026-45205
Log4j API/Core/1.2 bridge	2.25.3 → 2.26.1	CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480, CVE-2026-49844
PostgreSQL JDBC	42.7.8 → 42.7.12	CVE-2026-42198, CVE-2026-54291
Netty family	4.1.119.Final → 4.1.137.Final	34 CVEs, listed in the appendix

Test dependencies: JUnit 4.8.1 → 4.13.1 in command/donkey tests addresses CVE-2020-15250. This is separate from the 48 engine/runtime CVEs above.

Known remaining advisories: 4.7.0 ships PostgreSQL JDBC 42.7.12 and Jackson Core 2.18.8, which are affected by the advisories below. Each one applies only to the configuration or custom code its row describes, and custom code includes channel scripts. Apart from the two libraries themselves, nothing in the 4.7.0 download calls the affected Java APIs. These advisories are not in the addressed count, and this is not a complete vulnerability inventory of all shipped components.

Advisory	Component	Affects	Fixed in
CVE-2026-107314	PostgreSQL JDBC	If a connection URL's requireAuth value excludes all six authentication methods, or names none, the driver enforces no restriction. A positive list such as requireAuth=scram-sha-256 is enforced. No shipped configuration sets requireAuth.	42.7.14
CVE-2026-107315	PostgreSQL JDBC	If code declares a length larger than the data it sends through ByteStreamWriter, the COPY API, large objects or Blob.setBytes, the driver fills the padding with bytes of earlier statements, and the database stores them.	42.7.14
CVE-2026-89407	Jackson Core	NumberInput.looksLikeValidNumber takes time that grows with the square of the string's length, so a long untrusted string can tie up a thread. The bundled jackson-databind 2.14.3 does not call it.	2.18.11
CVE-2026-89425	Jackson Core	Parsing untrusted JSON from a java.io.DataInput, for example with ObjectMapper.readValue(DataInput), can build an error message as large as the input.	2.18.11
GHSA-hcjv-f5jh-r55v	PostgreSQL JDBC	If sslrootcert or sslcert points at a non-regular file such as /dev/zero, the connection attempt hangs.	No fixed release yet

Security: general improvements

Additional hardening for issues without a newly verified CVE ID:

• strict HL7 XML parsing
• custom metadata search names
• fresh-install credentials
• memory-only recent-filter history

Breaking changes and upgrade considerations

Initial administrator credentials and password policy

Fresh databases no longer initialize with admin/admin. Set server.initialadminpassword before the database's first initialization, or retrieve the generated administrator password from the first-startup server log. Changing this property later does not reset an existing account. Existing database credentials are retained. Update unattended installation and provisioning scripts accordingly. Credential initialization change.

The packaged default configuration now sets a 15-character password minimum, password.retrylimit = 100, and password.lockoutperiod = 1 (one hour). These are new configuration defaults; preserved configuration files are not automatically rewritten to these values. Review the defaults when replacing configuration files or provisioning a new server. Policy change.

XML messages containing DOCTYPE

DOCTYPE declarations are rejected in source XML passed to XSLT steps, XML batch splitting by element name, level, or XPath query, and the HL7 v2 strict XML parser. Integrations using DTDs or entity declarations in these inputs must send self-contained XML without DOCTYPE declarations. Ordinary XML and namespace handling remain supported; the strict HL7 XML parser also preserves CDATA content. XSLT fix, batch fix, strict HL7 fix, CDATA fix.

XSLT stylesheets remain trusted configuration: external stylesheet imports/includes and document() access are still supported. The source-message hardening does not impose a blanket external-resource ban on stylesheets.

HTTP Listener header limits

The new request-header-size setting retains the 8192-byte limit for legacy configurations that omit it. A configured value must resolve to a positive integer; invalid, unresolved, zero, or negative values fail connector startup. Check channel templates and API-imported settings before deployment. Final validation behavior.

Microsoft SQL Server JDBC encryption

The bundled Microsoft driver changes from 8.4.1.jre8 to 10.2.4.jre11. Starting with 10.2, Microsoft's driver enables encrypt=true by default. Even with encrypt=false, a server that requires encryption has its certificate validated unless trustServerCertificate=true is set. Connections that previously worked without a trusted, matching server certificate can fail after upgrading. If the engine's own database is on SQL Server through the Microsoft driver, the engine stops at startup with Error establishing connection to database, aborting startup and PKIX path building failed. Adding ;trustServerCertificate=true to database.url in mirth.properties lets it start, but skips certificate validation. A server certificate that the Java runtime trusts is the alternative. Verify TLS certificates and trust configuration for deployments using the Microsoft driver, including engine-database and channel connections. This particular change does not apply to connections using jTDS. Dependency change, Microsoft's 10.2 changes.

Bundled Java runtime

Installers that bundle a Java runtime now include Eclipse Temurin 21 instead of Azul Zulu 17. Installations that run on a separately installed Java are not affected, and Java 17 remains the minimum supported version. If you use custom JVM options or rely on Java 17-specific behavior, check them against Java 21 before upgrading.

oieserver.ps1 removed

oieserver.ps1 is no longer included in the release. Use the oieserver launcher instead.

API consumers and custom extensions

• Custom metadata filters must name configured columns exactly. Unknown names, including incorrect casing and stale filters referring to removed or renamed columns, are rejected before a search query runs. This applies to retrieval, counting, removal, reprocessing, and export. Synchronous invalid requests can return HTTP 500; asynchronous reprocessing failures are logged. Validation change.
• selectLimit is deprecated and no longer used. Database table metadata lookups no longer execute a supplied selectLimit query template; they use quoted identifiers and a zero-row query, with JDBC metadata fallback. Custom "Select with Limit Query" values in the Database Drivers settings and dbdrivers.xml are ignored. The selectLimit query parameter of POST /connectors/jdbc/_getTables, and the matching argument of DatabaseConnectorServletInterface.getTables in the Database Connector's extensions/jdbc/jdbc-shared.jar, are deprecated and ignored. See Upcoming changes for their removal. Fix.
• Custom controller/servlet implementations need updating. EngineController adds an abstract five-argument dispatchRawMessage overload, and MessageServletInterface adds processBatchMessage. The existing four-argument dispatch API remains available to callers. API change.
• The standalone extension JNLP endpoint is removed. Extension resources are included directly in the main launch descriptor, reducing startup requests. Update custom launchers that fetch /webstart/extensions/<extension>.jnlp and subclasses overriding the removed getExtensionJnlp(String) method. Main launch descriptors and extension JAR serving remain available. JNLP changes, endpoint removal.
• Other custom Java integrations: the Microsoft driver removes getAADSecretPrincipalId; the server-plugin accessor now returns a snapshot, and plugin de-duplication uses equals/hashCode; missing synchronized global-map keys now throw IllegalArgumentException instead of NullPointerException. Check custom code relying on these APIs or behaviors. Microsoft changes, plugin collection, global-map error.

Administrator, CLI, JSON, and build tooling

• Administrator now checks for JavaFX at startup. Use a launcher/runtime with the javafx.graphics module available; the client stops with a prerequisite message when it is missing. Java 17 remains the minimum Java version; that requirement was introduced in 4.6.0. Prerequisite check.
• CLI startup failures now return meaningful nonzero exit codes. Automation should handle authentication, connection, configuration, usage, and unreadable-script failures. This does not guarantee that every failed command inside a script changes the process exit code. CLI fix.
• Jackson-based JSON paths have new parsing limits. Jackson Core 2.18.8 introduces limits absent in the bundled 2.14.3 baseline, including nesting depth and token lengths. Test unusually deep or large JSON handled through Jackson-based utilities/custom code; this is not a claim that every OIE JSON parser uses Jackson. Jackson's default limits are 1,000 levels of nesting, 1,000 characters for a number, 20,000,000 characters for a string value and 50,000 characters for a property name. Document length and token count are unlimited.
• Source-build automation must migrate from Ant to Gradle. Use the included wrapper, for example ./gradlew build -PdisableSigning=true; source directories now follow the standard Gradle layout. Import the repository as a Gradle project instead of using the removed Eclipse project files. Build migration, source moves.

Upcoming changes

selectLimit will be removed

The deprecated selectLimit query parameter of POST /connectors/jdbc/_getTables, and the matching argument of DatabaseConnectorServletInterface.getTables in the Database Connector's extensions/jdbc/jdbc-shared.jar, will be removed in an upcoming release. Java code calling getTables will need to drop that argument when upgrading to the jdbc-shared.jar from that release.

Java Security Manager support will be removed

A future release will remove the remaining code that works with a Java Security Manager. That code makes privileged class-loader lookups when the Administrator, CLI and client library create API proxies, and selects the Security Manager's thread group for JavaScript worker threads. OIE never enables a Security Manager itself. This change only affects deployments that start the server, Administrator or CLI with -Djava.security.manager and a restrictive policy. After the removal, such a policy may need to grant RuntimePermission "getClassLoader". JavaScript threads will then join the creating thread's group whether or not a Security Manager is present. The Administrator launched from the shipped JNLP descriptor, which requests all permissions, is not affected. The Security Manager has been deprecated for removal since Java 17 and cannot be enabled on Java 24 and later. If you depend on it, comment on the pending change.

Fixes and improvements

• Keep Oracle prepared statements open until queued JDBC batch work executes, fixing failures caused by prematurely closed statements. Fix.
• Restore access to Java platform classes such as java.sql for isolated resource libraries, while retaining isolation from engine application classes. Fix.
• Start and stop registered server plugins once when a plugin implements multiple extension interfaces; preserve plugin ordering. Fix, final implementation.
• Ignore undefined preprocessor results instead of replacing the message, and treat blank channel scripts as absent. Preprocessor fix, blank-script fix.
• Make channelName available to channel postprocessor scripts. Fix.
• Report a clear IllegalArgumentException when global-variable lock/unlock helpers receive a key that was never registered for synchronization, instead of a null-pointer failure. Fix.
• Cache the compiled tree-search regular expression and use the connector-specific dashboard icon. Search improvement, icon fix.
• Correct launch-descriptor branding and reduce Administrator startup requests by embedding extension launch resources. Branding, launch resources.
• Replace the expired signing certificate used for signed artifacts. Certificate change.
• Make logging-library discovery independent of hard-coded Log4j JAR versions. Fix.
• Add a final-comment safeguard to the custom JVM-options template so options inserted above it retain their newline. JVM options.
• Fix Java detection/server startup under PowerShell 5.1 (local builds only). PowerShell.

Build and validation improvements

Dependencies are resolved from a centralized version catalog with checksum verification and distribution-placement checks. Netty and Log4j modules share version definitions to prevent mismatched family upgrades. Renovate maintains dependency updates. Dependency migration, family alignment.

The Docker-based CI harness exercises Derby, PostgreSQL, MySQL, Oracle, and SQL Server, with Alpine/Ubuntu configurations where defined. Coverage now includes malicious XML, database metadata, multi-message batches, CDATA preservation, and CLI failures. Test execution is faster and less prone to timing races. The repository contains the Docker build; these notes do not announce a new published image or registry tag. CI harness, CLI smoke tests, file-poll test fix.

Appendix

Netty CVEs addressed

CVE	Affected bundled module
CVE-2025-55163	codec-http2
CVE-2025-58056	codec-http
CVE-2025-58057	codec
CVE-2025-67735	codec-http
CVE-2026-33870	codec-http
CVE-2026-33871	codec-http2
CVE-2026-41417	codec-http
CVE-2026-42580	codec-http
CVE-2026-42581	codec-http
CVE-2026-42583	codec
CVE-2026-42584	codec-http
CVE-2026-42585	codec-http
CVE-2026-42587	codec-http, codec-http2
CVE-2026-44249	handler
CVE-2026-45416	handler
CVE-2026-45536	transport-native-epoll
CVE-2026-47244	codec-http2
CVE-2026-48043	codec-http2
CVE-2026-50010	handler
CVE-2026-50020	codec-http
CVE-2026-50560	codec-http2
CVE-2026-55831	codec-http
CVE-2026-55833	codec-http
CVE-2026-56745	codec-http
CVE-2026-56746	codec-http
CVE-2026-56819	codec-http2
CVE-2026-59898	codec-http
CVE-2026-59899	codec-http
CVE-2026-59900	codec-http2
CVE-2026-59901	codec
CVE-2026-59903	codec-http
CVE-2026-59921	codec-http
CVE-2026-75595	handler
CVE-2026-75596	handler