io.awspring.cloud:spring-cloud-aws-starter-integration-sns (>=4.0.0-rc1, <=4.2.0), org.citrusframework.mvn:citrus-maven-plugin (5.0.0-m1) +34 more potentially affected by CVE-2026-47864 via org.springframework.integration:spring-integration-http (>=7.0.0, <=7.0.5)

org.springframework.integration:spring-integration-http MAVEN version =7.0.0, =4.0.0-rc1, =4.2.0 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-agent-connector 5.0.0-m1 - org.citrusframework:citrus-cucumber-all 5.0.0-m1 - org.citrusframework:citrus-cucumber-ht...

io.awspring.cloud:spring-cloud-aws-starter-integration-sns (>=4.0.0-m1, <=4.2.0), org.citrusframework.mvn:citrus-maven-plugin (5.0.0-m1) +34 more potentially affected by CVE-2026-47864 via org.springframework.integration:spring-integration-http (>=7.0.0-m1, <=7.0.5)

org.springframework.integration:spring-integration-http MAVEN version =7.0.0-m1, =4.0.0-m1, =4.2.0 - org.citrusframework.mvn:citrus-maven-plugin 5.0.0-m1 - org.citrusframework:citrus-agent-connector 5.0.0-m1 - org.citrusframework:citrus-cucumber-all 5.0.0-m1 -...

CVE-2026-44308

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

CVE-2026-44308 Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

CVE-2026-44308

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

CVE-2026-44308

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

EUVD-2026-30302

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

CVE-2026-44308 Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

be.appify.prefab:prefab-sns-sqs (>=0.4.0, <=0.7.1), be.appify.prefab:prefab-test (>=0.4.0, <=0.7.1) +8 more potentially affected by CVE-2026-44308 via io.awspring.cloud:spring-cloud-aws-sns (>=4.0.0, <=4.0.1)

io.awspring.cloud:spring-cloud-aws-sns MAVEN version =4.0.0, =0.4.0, =0.4.0, =4.0.0, =4.0.0, =4.0.0, =2.1.0, =1.3.0, =7.0.0-beta2, =7.0.0-beta2, =7.3.1 Source cves: CVE-2026-44308 Source advisory: MEND:CVE-2026-44308...

CVE-2026-44308

CVE-2026-44308 concerns Spring Cloud AWS, where the SNS HTTP/HTTPS endpoint support methods (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) failed to verify incoming SNS message signatures from versions 3.0.0 through 4.0.1. An unauthent...

CVE-2026-44308 Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

Spring Cloud AWS Data Forgery Vulnerability

Spring Cloud AWS is an open-source development framework from awspring, designed for integration with AWS cloud services within the Spring ecosystem. Versions 3.0.0 to 4.0.1 of Spring Cloud AWS contain a data manipulation vulnerability. This vulnerability stems from the lack of validation of the...

CVE-2026-44308: Insufficient Verification of Data Authenticity

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

be.appify.prefab:prefab-sns-sqs (>=0.4.0, <=0.7.1), be.appify.prefab:prefab-test (>=0.4.0, <=0.7.1) +8 more potentially affected by CVE-2026-44308 via io.awspring.cloud:spring-cloud-aws-sns (>=4.0.0, <=4.0.1)

io.awspring.cloud:spring-cloud-aws-sns MAVEN version =4.0.0, =0.4.0, =0.4.0, =4.0.0, =4.0.0, =4.0.0, =2.1.0, =1.3.0, =7.0.0-beta2, =7.0.0-beta2, =7.3.1 Source cves: CVE-2026-44308 Source advisory: OSV:GHSA-R4W4-WV68-QV85...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the SNS HTTP/HTTPS notification endpoints due to missing signature verification. An attacker can cause the application to process arbitrary payloads as legitimate notifications, auto-confi...

GHSA-R4W4-WV68-QV85 Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

Impact Applications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did not verify the signature of incoming SNS messages. An unauthenticated attacker who knows the endpoint URL could...

Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

Impact Applications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did not verify the signature of incoming SNS messages. An unauthenticated attacker who knows the endpoint URL could...

com.limemojito.oss.spring-boot:aws-utilities (>=11.0.0, <=12.0.7), com.limemojito.oss.standards:aws-utilities (>=13.0.0, <=14.1.0) +8 more potentially affected by CVE-2026-44308 via io.awspring.cloud:spring-cloud-aws-sns (>=3.0.0, <=3.4.2)

io.awspring.cloud:spring-cloud-aws-sns MAVEN version =3.0.0, =11.0.0, =13.0.0, =3.2.0-m1, =3.0.0, =0.16.0, =1.1.0, =0.0.1, =2.1.0, =2.0.0-beta-17, =7.0.0-beta Source cves: CVE-2026-44308 Source advisory: GHSA-R4W4-WV68-QV85...

com.limemojito.oss.spring-boot:aws-utilities (>=11.0.0, <=12.0.7), com.limemojito.oss.standards:aws-utilities (>=13.0.0, <=14.1.0) +8 more potentially affected by CVE-2026-44308 via io.awspring.cloud:spring-cloud-aws-sns (>=3.0.0, <=3.4.2)

io.awspring.cloud:spring-cloud-aws-sns MAVEN version =3.0.0, =11.0.0, =13.0.0, =3.2.0-m1, =3.0.0, =0.16.0, =1.1.0, =0.0.1, =2.1.0, =2.0.0-beta-17, =7.0.0-beta Source cves: CVE-2026-44308 Source advisory: OSV:GHSA-R4W4-WV68-QV85...

be.appify.prefab:prefab-sns-sqs (>=0.4.0, <=0.7.1), be.appify.prefab:prefab-test (>=0.4.0, <=0.7.1) +8 more potentially affected by CVE-2026-44308 via io.awspring.cloud:spring-cloud-aws-sns (>=4.0.0-m1, <=4.0.1)

io.awspring.cloud:spring-cloud-aws-sns MAVEN version =4.0.0-m1, =0.4.0, =0.4.0, =4.0.0-m1, =4.0.0-m1, =4.0.0-m1, =2.1.0, =1.3.0, =7.0.0-beta2, =7.0.0-beta2, =7.3.1 Source cves: CVE-2026-44308 Source advisory: SNYK:JAVA-IOAWSPRINGCLOUD-16799818...