CVE-2026-59302 Potential for logging sensitive data in Spring Cloud Stream

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59302

A flaw in Spring Cloud Stream versions 4.2.0 - 4.2.6 , 4.3.0 - 4.3.3 , and 5.0.0 - 5.0.2 allows for the unintended logging of sensitive data . This vulnerability could lead to a low-impact information disclosure where confidential information is exposed within application logs under certain condi...

EUVD-2026-67188

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59302 Potential for logging sensitive data in Spring Cloud Stream

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

com.oracle.database.spring.cloud-stream-binder:spring-cloud-stream-binder-oracle-txeventq (>=0.20.0, <=0.21.0), com.solace.connector.core.io:spring-cloud-stream-binder-jms (5.0.1) +2 more potentially affected by CVE-2026-47880 via org.springframework.integration:spring-integration-jms (7.1.0)

org.springframework.integration:spring-integration-jms MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-jms and may be impacted: -...

com.oracle.database.spring.cloud-stream-binder:spring-cloud-stream-binder-oracle-txeventq (>=0.17.0, <=0.19.0), org.springframework.cloud.fn:spring-jms-supplier (6.0.0) potentially affected by CVE-2026-47880 via org.springframework.integration:spring-integration-jms (>=7.0.2, <=7.0.4)

org.springframework.integration:spring-integration-jms MAVEN version =7.0.2, =0.17.0, =0.19.0 - org.springframework.cloud.fn:spring-jms-supplier 6.0.0 Source cves: CVE-2026-47880 Source advisory: MEND:CVE-2026-47880...

CVE-2026-59305: Incorrect Behavior Order

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

PT-2026-82714

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59306: Deserialization of Untrusted Data

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59302: Insertion of Sensitive Information into Log File

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

PT-2026-82713

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

PT-2026-82710

Name of the Vulnerable Software and Affected Versions Spring Cloud Stream versions 5.0.0 through 5.0.2 Spring Cloud Stream versions 4.3.0 through 4.3.3 Spring Cloud Stream versions 4.2.0 through 4.2.6 Description There is a potential for the application to log sensitive data within the framework...

PT-2026-82712

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

PT-2026-82711

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59304: Access of Resource Using Incompatible Type

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59303: Allocation of Resources Without Limits or Throttling

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=9.3.0) +466 more potentially affected by CVE-2026-59306 via org.springframework.cloud:spring-cloud-stream (>=4.2.0, <=5.0.2)

org.springframework.cloud:spring-cloud-stream MAVEN version =4.2.0, =17.16.0, =5.0.5, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =3.5.5.2 and more Source cves: CVE-2026-59306https://vulners.com/cve/C...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization. An attacker can execute arbitrary code or manipulate application behavior by supplying specially crafted input that is deserialized without proper validation. Details Serializati...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper restriction of the dynamic destination cache size. An attacker can cause unintended information disclosure or modification by exploiting the lack of proper bounds on t...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...