Description
Improper caching of the original content type in Spring Cloud Stream Avro.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4.2.6
Published: 2026-08-27
Score: 3.1 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Spring Cloud Stream Avro incorrectly caches the original content type of messages, which can cause the framework to interpret data with an unexpected content type. This flaw may lead to incorrect data interpretation, data integrity problems, or unintended processing paths. No official impact such as code execution is cited in the advisory.

Affected Systems

Spring Cloud Stream, versions 5.0.0 through 5.0.2, 4.3.0 through 4.3.3, and 4.2.0 through 4.2.6 are affected.

Risk and Exploitability

The CVSS score is 3.1, indicating low severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, suggesting limited exposure and a low probability of exploitation. The flaw likely requires message traffic to the application, implying the attack vector is internal or remote via the messaging layer. No active exploitation has been reported.

Generated by OpenCVE AI on August 28, 2026 at 06:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to a patched release of Spring Cloud Stream (e.g., 5.0.3 or later, 4.3.4 or later, 4.2.7 or later).
  • Disable or clear any custom cache that holds the original content type, ensuring that each message’s content type is evaluated afresh.
  • Review and enforce strict content type validation in message processing to prevent incorrect interpretation of payloads.

Generated by OpenCVE AI on August 28, 2026 at 06:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://spring.io/security/cve-2026-59304 cve-icon cve-icon
History

Fri, 28 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-464
CWE-751

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
Title Improper caching of the original content type in Spring Cloud Stream Avro
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-08-27T17:58:00.802Z

Reserved: 2026-07-04T18:13:46.708Z

Link: CVE-2026-59304

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-27T20:17:56.760

Modified: 2026-08-27T20:17:56.760

Link: CVE-2026-59304

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T07:00:12Z

Weaknesses