Spring Cloud Stream allows administrators to configure a dynamic destination cache that can grow to arbitrary sizes. Because the framework does not enforce upper limits on this cache size, a malicious or misconfigured user could create an excessively large cache, consuming significant amounts of memory and potentially exhausting system resources. This uncontrolled resource consumption can lead to application slowdown, stale cached data, or a complete failure to service legitimate requests, effectively denying access to users.

This vulnerability affects the Spring Cloud Stream framework. The impacted versions are 5.0.0 through 5.0.2, 4.3.0 through 4.3.3, and 4.2.0 through 4.2.6. Any deployment of these releases should verify the used version and assess whether configuration channels are exposed to administrators or to untrusted users that can influence cache settings.

The CVSS score of 3.1 indicates low overall severity. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack requires a means to alter destination cache settings, which likely involves access to configuration interfaces or trusted network connections. Successful exploitation may cause the application to consume excessive memory and become unresponsive, impacting availability of the service but not necessarily exposing data or altering integrity.