Spring Cloud Stream processes messages by automatically deserializing payloads into Java objects. When a message containing an untrusted type is received, an attacker can craft a payload that, upon deserialization, may trigger unchecked object creation or method invocation, potentially allowing arbitrary code execution or compromised application behavior. This flaw is the result of insufficient validation of the data type being deserialized, a weakness catalogued as CWE‑346.

The flaw affects Spring Cloud Stream versions 5.0.0 through 5.0.2, 4.3.0 through 4.3.3, and 4.2.0 through 4.2.6. Any installation of Spring Cloud Stream in this version range that processes external messages is at risk if untrusted payloads are accepted.

The CVSS score of 3.1 indicates a low overall severity, and the EPSS score is not available, so the current likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to inject a crafted message into the message broker or gateway that the vulnerable application consumes. If the message is processed, the attacker may achieve code execution or related impacts depending on application context.