CVE-2026-59304

Received Received - Intake

Improper Content-Type Caching in Spring Cloud Stream

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description

Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-59304

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_cloud_stream	to 5.0.2 (inc)
vmware	spring_cloud_stream	to 4.3.3 (inc)
vmware	spring_cloud_stream	to 4.2.6 (inc)
vmware	spring_cloud_stream	From 4.2.0 (inc) to 5.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

CVE-2026-59304 is a vulnerability in Spring Cloud Stream Avro where the original content type is improperly cached. This could lead to security risks by allowing incorrect handling of data types during processing.

Detection Guidance

Detection primarily involves checking the installed version of Spring Cloud Stream. Use commands like 'find . -name "spring-cloud-stream*.jar" | xargs ls -l' to locate JAR files and check their versions. Compare against affected ranges (5.0.0-5.0.2, 4.3.0-4.3.3, 4.2.0-4.2.6).

Impact Analysis

The vulnerability may cause unintended data processing due to cached content types, potentially leading to information disclosure or integrity issues. However, the impact is limited as the CVSS score indicates low severity.

Mitigation Strategies

Upgrade to fixed versions: 5.0.3 for OSS, 4.3.4 for Enterprise Support Only, or 4.2.7 for Enterprise Support Only. No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59304. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70