CVE-2026-59297

Analyzed Analyzed - Analysis Complete

ServerlessHttpServletRequest Scheme Validation Bypass in Spring Cloud Function

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-18

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59297

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_cloud_function	From 5.0.0 (inc) to 5.0.4 (exc)
vmware	spring_cloud_function	From 4.2.0 (inc) to 4.2.8 (exc)
vmware	spring_cloud_function	From 4.3.0 (inc) to 4.3.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

The vulnerability in Spring Cloud Function involves the isSecure() method in ServerlessHttpServletRequest not properly checking the URI scheme. This means the method may incorrectly report whether a connection is secure, potentially allowing unencrypted traffic to be treated as secure.

Detection Guidance

To detect this vulnerability, check the version of Spring Cloud Function in use. If your system runs versions 5.0.0-5.0.3, 4.3.0-4.3.4, or 4.2.0-4.2.7, it is vulnerable. Use commands like 'find / -name spring-cloud-function*.jar' to locate the library and 'java -jar your-application.jar --version' to check the version.

Impact Analysis

This flaw could lead to sensitive data being transmitted over insecure channels without detection. Attackers might exploit this to intercept or manipulate data under the false assumption that it is protected.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing incorrect determination of secure connections. If the isSecure() method fails to verify the URI scheme, sensitive data transmitted over insecure channels might be mishandled, violating requirements for secure data transmission in these regulations.

Mitigation Strategies

Upgrade affected Spring Cloud Function versions to fixed releases: 5.0.4 for OSS, 4.3.5 or 4.2.8 for Enterprise Support Only. No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59297. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70