CVE-2026-59297

Published: Aug 27, 2026Modified: Sep 2, 2026

3.5

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Exploitability: 0.9 / Impact: 2.5

Source: NVD

Description

Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

Affected (3)

Products: Vmware: Spring Cloud Function

Vmware

1 product

Spring Cloud Function

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Cloud Function	From 4.2.0 to 4.2.8
Vmware Spring Cloud Function	From 4.3.0 to 4.3.5
Vmware Spring Cloud Function	From 5.0.0 to 5.0.4

Related CWEs

CWE-346

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (1)

https://spring.io/security/cve-2026-59297

Source: security@vmware.com

Vendor Advisory

Timeline

No history available yet.