CVE-2026-59306

Analyzed Analyzed - Analysis Complete

Deserialization Flaw in Spring Cloud Stream

Publication date: 2026-08-27

Last updated on: 2026-09-04

Assigner: VMware

Description

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-04

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59306

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_cloud_stream	From 4.2.0 (inc) to 4.2.7 (exc)
vmware	spring_cloud_stream	From 4.3.0 (inc) to 4.3.4 (exc)
vmware	spring_cloud_stream	From 5.0.0 (inc) to 5.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability involves the potential for deserialization of untrusted types in Spring Cloud Stream. It affects specific versions of Spring Cloud Stream where malicious input could lead to unintended code execution or data tampering during deserialization processes.

Detection Guidance

Detection involves checking installed Spring Cloud Stream versions. Use commands like 'find / -name spring-cloud-stream-*.jar' to locate versions. Compare against affected ranges: 5.0.0-5.0.2, 4.3.0-4.3.3, 4.2.0-4.2.6.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code or manipulate data by sending specially crafted serialized objects. This may lead to unauthorized access, data breaches, or service disruption in applications using affected versions of Spring Cloud Stream.

Compliance Impact

The vulnerability involves deserialization of untrusted types, which could lead to remote code execution or data breaches if exploited. This may impact compliance with GDPR (data protection) and HIPAA (health data security) by increasing risks of unauthorized access to sensitive data. Organizations using affected versions should upgrade to mitigate these risks.

Mitigation Strategies

Upgrade to fixed versions: 5.0.3 for OSS, 4.3.4 for Enterprise Support, or 4.2.7 for Enterprise Support Only. No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59306. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70