Improper Message Interceptor Addition in Spring Cloud Stream

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description

Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-59305

Affected Vendors & Products

Vendor	Product	Version / Range
spring	cloud_stream	From 4.2.0 (inc) to 4.2.6 (inc)
spring	cloud_stream	From 4.3.0 (inc) to 4.3.3 (inc)
spring	cloud_stream	From 5.0.0 (inc) to 5.0.2 (inc)
spring_project	spring_cloud_stream	From 5.0.0 (inc) to 5.0.2 (inc)
spring_project	spring_cloud_stream	From 4.3.0 (inc) to 4.3.3 (inc)
spring_project	spring_cloud_stream	From 4.2.0 (inc) to 4.2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves a security issue in Spring Cloud Stream where a partition interceptor may be improperly added while sending messages. This could lead to unintended message handling or interception in versions 5.0.0 to 5.0.2, 4.3.0 to 4.3.3, and 4.2.0 to 4.2.6.

Impact Analysis

The improper addition of a partition interceptor could allow unauthorized message interception or manipulation, potentially leading to data leaks or integrity issues. The impact is limited due to a low CVSS score of 3.1, indicating a lower severity.

Mitigation Strategies

Upgrade to fixed versions: Spring Cloud Stream 5.0.3, 4.3.4 (Enterprise only), or 4.2.7 (Enterprise only). No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59305. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70