Description
Improper caching of the original content type in Spring Cloud Stream Avro.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4.2.6
Published: 2026-08-27
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: Potential data integrity and processing issues
Action: Apply patch
AI Analysis

Impact

Spring Cloud Stream Avro incorrectly caches the original content type of messages, which can cause the framework to interpret data with an unexpected content type. This flaw may lead to incorrect data interpretation, data integrity problems, or unintended processing paths. No official impact such as code execution is cited in the advisory.

Affected Systems

Spring Cloud Stream, versions 5.0.0 through 5.0.2, 4.3.0 through 4.3.3, and 4.2.0 through 4.2.6 are affected.

Risk and Exploitability

The CVSS score is 3.1, indicating low severity. The EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA KEV, suggesting limited exposure and a low probability of exploitation. The flaw likely requires message traffic to the application, implying the attack vector is internal or remote via the messaging layer. No active exploitation has been reported.

Generated by OpenCVE AI on August 29, 2026 at 02:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a patched release of Spring Cloud Stream (e.g., 5.0.3 or later, 4.3.4 or later, 4.2.7 or later).
  • Disable or clear any custom cache that holds the original content type, ensuring that each message’s content type is evaluated afresh.
  • Review and enforce strict content type validation in message processing to prevent incorrect interpretation of payloads.

Generated by OpenCVE AI on August 29, 2026 at 02:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://spring.io/security/cve-2026-59304 cve-icon cve-icon
History

Fri, 04 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Vmware
Vmware spring Cloud Stream
CPEs cpe:2.3:a:vmware:spring_cloud_stream:*:*:*:*:*:*:*:*
Vendors & Products Vmware
Vmware spring Cloud Stream

Tue, 01 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Spring
Spring spring Cloud Stream
Vendors & Products Spring
Spring spring Cloud Stream

Sat, 29 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-464
CWE-751

Fri, 28 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-843
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 28 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-464
CWE-751

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
Title Improper caching of the original content type in Spring Cloud Stream Avro
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

Spring Spring Cloud Stream
Vmware Spring Cloud Stream
cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-08-28T22:47:36.173Z

Reserved: 2026-07-04T18:13:46.708Z

Link: CVE-2026-59304

cve-icon Vulnrichment

Updated: 2026-08-28T19:10:18.710Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-27T20:17:56.760

Modified: 2026-09-04T19:28:29.470

Link: CVE-2026-59304

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T14:22:38Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')