CVE-2026-59306 Potential for deserialization of untrusted types in Spring Cloud Stream

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

EUVD-2026-67194

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59306

Spring Cloud Stream is affected by a potential deserialization of untrusted types vulnerability. The impacted versions are 5.0.0–5.0.2 , 4.3.0–4.3.3 , and 4.2.0–4.2.6 . The CNA-assigned CVSS v3.1 score is 3.1 (Low) , reflecting a network attack vector with high complexity, high privileges require...

CVE-2026-59313

Spring MVC applications utilizing the functional web framework are vulnerable to stream corruption when implementing Server-Sent Events (SSE) . This flaw can lead to unreliable data delivery and compromise the integrity of information presented to users. Affected versions include Spring Framework...

EUVD-2026-67193

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

CVE-2026-59313 Server Sent Event stream corruption in Spring MVC functional web framework

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.astraform:remote-domain-template-java-spring (0.2.0) +3997 more potentially affected by CVE-2026-59313 via org.springframework:spring-webmvc (>=7.0.0, <=7.0.8)

org.springframework:spring-webmvc MAVEN version =7.0.0, =0.1.0, =0.0.1, =0.0.1, =4.13.5, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0-beta-2, =2.0.0-beta-1, =0.1.1, =0.1.1, =0.2.0 and more Source cves: CVE-2026-59313 Source advisory: MEND:CVE-2026-59313...

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

CVE-2026-59313 Server Sent Event stream corruption in Spring MVC functional web framework

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

EUVD-2026-67192

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59307

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59307

Spring Integration JdbcMessageStore has a deserialization allow-list bypass. When the store is a Spring-managed bean , calling addAllowedPatterns(...) to restrict deserialization is silently ineffective because setBeanClassLoader (invoked during Spring's bean lifecycle) replaces the deserializer ...

CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59307 Deserialization allow-list silently bypassed: setBeanClassLoader replaces deserializer but mapper keeps stale reference

An operator who calls JdbcMessageStore.addAllowedPatterns... to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12...

CVE-2026-59305 Partition interceptor may be improperly added while sending message

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

EUVD-2026-67191

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59305

Spring Cloud Stream versions 4.2.0–4.2.6, 4.3.0–4.3.3, and 5.0.0–5.0.2 are affected by an issue where the partition interceptor may be improperly added while sending a message. The vulnerability is rated LOW severity (CVSS 3.1: 3.1), requiring high privileges, user interaction, and presenting hig...

CVE-2026-59305

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...