CVE-2026-59304

Analyzed Analyzed - Analysis Complete

Improper Content-Type Caching in Spring Cloud Stream

Publication date: 2026-08-27

Last updated on: 2026-09-04

Assigner: VMware

Description

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-04

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59304

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_cloud_stream	From 4.2.0 (inc) to 4.2.7 (exc)
vmware	spring_cloud_stream	From 4.3.0 (inc) to 4.3.4 (exc)
vmware	spring_cloud_stream	From 5.0.0 (inc) to 5.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

CVE-2026-59304 is a vulnerability in Spring Cloud Stream Avro where the original content type is improperly cached. This could lead to security risks by allowing incorrect handling of data types during processing.

Detection Guidance

Detection primarily involves checking the installed version of Spring Cloud Stream. Use commands like 'find . -name "spring-cloud-stream*.jar" | xargs ls -l' to locate JAR files and check their versions. Compare against affected ranges (5.0.0-5.0.2, 4.3.0-4.3.3, 4.2.0-4.2.6).

Impact Analysis

The vulnerability may cause unintended data processing due to cached content types, potentially leading to information disclosure or integrity issues. However, the impact is limited as the CVSS score indicates low severity.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA. The issue involves improper caching of content type in Spring Cloud Stream Avro, which has limited security impact (low CVSS score). No data confidentiality or integrity breaches are indicated, so standard compliance controls remain unaffected.

Mitigation Strategies

Upgrade to fixed versions: 5.0.3 for OSS, 4.3.4 for Enterprise Support Only, or 4.2.7 for Enterprise Support Only. No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59304. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70