CVE-2026-59305

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59304

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59306

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59302

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59303

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59306

Spring Cloud Stream is affected by a potential deserialization of untrusted types vulnerability. The impacted versions are 5.0.0–5.0.2 , 4.3.0–4.3.3 , and 4.2.0–4.2.6 . The CNA-assigned CVSS v3.1 score is 3.1 (Low) , reflecting a network attack vector with high complexity, high privileges require...

EUVD-2026-67194

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59306 Potential for deserialization of untrusted types in Spring Cloud Stream

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

EUVD-2026-67193

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

CVE-2026-59313

Spring MVC applications using the functional web framework are vulnerable to stream corruption in the ServerResponse.sse process. An attacker who can control the streamed data can inject malformed data into Server-Sent Events, corrupting the stream for other users. Exploitation requires the appli...

CVE-2026-59313 Server Sent Event stream corruption in Spring MVC functional web framework

Spring MVC applications using the functional web framework are vulnerable to stream corruption when using Server-Sent Events SSE. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49...

EUVD-2026-67191

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59305

Spring Cloud Stream versions 4.2.0–4.2.6, 4.3.0–4.3.3, and 5.0.0–5.0.2 are affected by an issue where the partition interceptor may be improperly added while sending a message. The vulnerability is rated LOW severity (CVSS 3.1: 3.1), requiring high privileges, user interaction, and presenting hig...

CVE-2026-59305 Partition interceptor may be improperly added while sending message

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59304 Improper caching of the original content type in Spring Cloud Stream Avro

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

EUVD-2026-67190

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59304

Spring Cloud Stream Avro is affected by an improper caching of the original content type, leading to potential confidentiality and integrity impact at a low severity (CVSS 3.1). The affected versions are Spring Cloud Stream 5.0.0–5.0.2 , 4.3.0–4.3.3 , and 4.2.0–4.2.6 . The CVSS vector (AV:N/AC:H/...

EUVD-2026-67189

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...

CVE-2026-59303

Spring Cloud Stream contains a vulnerability where the dynamic destination cache size is not properly bounded, affecting versions 5.0.0–5.0.2 , 4.3.0–4.3.3 , and 4.2.0–4.2.6 . The flaw allows an unbounded cache to grow, which could lead to resource exhaustion under specific conditions. The CVSS 3...