Spring Cloud Stream vulnerabilities

Latest Spring Cloud Stream CVEs

Newest publication first

1. CVE-2026-59306 Potential for deserialization of untrusted types in Spring Cloud Stream

   Published 2026-08-27

   Low·CVSS 3.1

   Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

2. CVE-2026-59305 Partition interceptor may be improperly added while sending message

   Published 2026-08-27

   Low·CVSS 3.1

   Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

3. CVE-2026-59304 Improper caching of the original content type in Spring Cloud Stream Avro

   Published 2026-08-27

   Low·CVSS 3.1

   Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

4. CVE-2026-59303 Dynamic destination cache size is not properly bound in Spring Cloud Stream

   Published 2026-08-27

   Low·CVSS 3.1

   Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

5. CVE-2026-59302 Potential for logging sensitive data in Spring Cloud Stream

   Published 2026-08-27

   Low·CVSS 3.1

   Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.