CVE-2026-59306
Received
Received - Intake
Deserialization Flaw in Spring Cloud Stream
Vulnerability report for CVE-2026-59306, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-27
Last updated on: 2026-08-27
Assigner: VMware
Description
Description
Potential for deserialization of untrusted types in Spring Cloud Stream.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4.2.6
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vmware | spring_cloud_stream | From 4.2.0 (inc) to 4.2.6 (inc) |
| vmware | spring_cloud_stream | From 4.3.0 (inc) to 4.3.3 (inc) |
| vmware | spring_cloud_stream | From 5.0.0 (inc) to 5.0.2 (inc) |
| vmware | spring_cloud_stream | From 4.2.0 (inc) to 5.0.2 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
