CVE-2026-59303
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In Spring Cloud Stream, the dynamic destination cache size is not properly bound, which may lead to uncontrolled memory growth or other resource issues.
Risk Assessment
Improper binding of cache size may lead to resource exhaustion, potentially causing application failure or DoS attacks.
Recommendation
Update Spring Cloud Stream to a patched version or configure appropriate cache limits.
Other vulnerabilities in Spring Cloud Stream
See all- CVE-2026-59306Low
Vulnerability in Spring Cloud Stream allows deserialization of untrusted types, which may lead to remote code execution or other deserialization attacks.
- CVE-2026-59305Low
In Spring Cloud Stream, the partition interceptor may be improperly added while sending a message, which could lead to unexpected behavior in message processing.
- CVE-2026-59304Low
In Spring Cloud Stream Avro, improper caching of the original content type may lead to incorrect processing of Avro data.
- CVE-2026-59302Low
In Spring Cloud Stream, there is a potential for logging sensitive data, which may lead to leakage of confidential information into logs.
Original NVD description (English source)
Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
Vulnerability data from NVD (NIST) · CISA KEV · EPSS