SB2026083165 - Multiple vulnerabilities in Spring Cloud Stream
Published: August 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-59302)
CWE-ID: CWE-532 - Information Exposure Through Log Files
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper handling of sensitive information in logging functionality in Spring Cloud Stream when processing application data that is written to logs. A remote privileged user can trigger logging of sensitive data to disclose sensitive information.
User interaction is required.
2) Buffer overflow (CVE-ID: CVE-2026-59303)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and modify data.
The vulnerability exists due to improper bounds restriction in dynamic destination cache size handling when processing dynamic destinations. A remote privileged user can interact with crafted dynamic destinations to disclose sensitive information and modify data.
User interaction is required.
3) Use of cache containing sensitive information (CVE-ID: CVE-2026-59304)
CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose limited sensitive information and modify limited data.
The vulnerability exists due to improper caching of the original content type in Spring Cloud Stream Avro when processing avro content. A remote privileged user can use specially crafted content handling conditions to disclose limited sensitive information and modify limited data.
User interaction is required.
4) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-59305)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and affect message integrity.
The vulnerability exists due to improper interceptor handling in the message sending functionality when sending messages. A remote privileged user can send a message to disclose sensitive information and affect message integrity.
User interaction is required.
5) Deserialization of Untrusted Data (CVE-ID: CVE-2026-59306)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to deserialize untrusted types.
The vulnerability exists due to unsafe deserialization in Spring Cloud Stream when handling specially crafted input. A remote privileged user can supply crafted data to deserialize untrusted types.
User interaction is required.
Remediation
Install update from vendor's website.