Buffer overflow in Spring Cloud Stream - CVE-2026-59303
Published: August 31, 2026
Vulnerability identifier: #VU146428
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-59303
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and modify data.
The vulnerability exists due to improper bounds restriction in dynamic destination cache size handling when processing dynamic destinations. A remote privileged user can interact with crafted dynamic destinations to disclose sensitive information and modify data.
User interaction is required.
Affected software
Spring Cloud Stream
Library Support for Spring
Library Support for Spring
How to mitigate CVE-2026-59303
Install security update from vendor's website.
Spring Cloud Stream - addressed in versions 4.2.7, 4.3.4, 5.0.3
Library Support for Spring - update to 3.5.19
Library Support for Spring - update to 3.5.19