CVE Catalog
CVE-2026-59297
LowCVSS 3.1Summary
The implementation of isSecure() in ServerlessHttpServletRequest does not verify the actual scheme, which may lead to incorrect determination of connection security.
Risk Assessment
Incorrect determination of connection security may lead to treating requests as secure when they are not, potentially enabling downgrade attacks or data integrity breaches.
Recommendation
Update Spring Cloud Function to a patched version or manually verify the request scheme in your application.
Original NVD description (English source)
Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7