CVE-2026-59306

Published: Aug 27, 2026Modified: Sep 4, 2026

3.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Exploitability: 1.2 / Impact: 2.5

Source: NVD

Description

Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

Affected (3)

Products: Vmware: Spring Cloud Stream

Vmware

1 product

Spring Cloud Stream

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Vmware Spring Cloud Stream	From 4.2.0 to 4.2.7
Vmware Spring Cloud Stream	From 4.3.0 to 4.3.4
Vmware Spring Cloud Stream	From 5.0.0 to 5.0.3

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (1)

https://spring.io/security/cve-2026-59306

Source: security@vmware.com

PatchVendor Advisory

Timeline

No history available yet.