CVE-2026-59306
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in Spring Cloud Stream allows deserialization of untrusted types, which may lead to remote code execution or other deserialization attacks.
Risk Assessment
An attacker could exploit this vulnerability to execute malicious code in the context of the application, potentially leading to system compromise or data breach.
Recommendation
Update Spring Cloud Stream to a patched version or apply available security fixes.
Other vulnerabilities in Spring Cloud Stream
See all- CVE-2026-59305Low
In Spring Cloud Stream, the partition interceptor may be improperly added while sending a message, which could lead to unexpected behavior in message processing.
- CVE-2026-59304Low
In Spring Cloud Stream Avro, improper caching of the original content type may lead to incorrect processing of Avro data.
- CVE-2026-59303Low
In Spring Cloud Stream, the dynamic destination cache size is not properly bound, which may lead to uncontrolled memory growth or other resource issues.
- CVE-2026-59302Low
In Spring Cloud Stream, there is a potential for logging sensitive data, which may lead to leakage of confidential information into logs.
Original NVD description (English source)
Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
Vulnerability data from NVD (NIST) · CISA KEV · EPSS