CVE-2026-44308

Overview

Spring Cloud AWS simplifies using AWS managed services such as SNS, SQS, S3 and Parameter Store in Spring and Spring Boot applications. Its SNS module lets a Spring MVC controller act as an HTTP/HTTPS endpoint for an SNS topic, receiving notifications and handling subscription and unsubscription confirmations.

A signature forgery vulnerability (CVE-2026-44308) has been identified in the Spring Cloud AWS SNS HTTP/HTTPS endpoint support, which allows attackers to send forged SNS messages that the application accepts as genuine. An unauthenticated attacker who knows the endpoint URL can make the application process arbitrary payloads as SNS notifications, or confirm subscriptions to, or unsubscribe from, topics the attacker controls.

Per OWASP: Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations.

This issue affects multiple versions of Spring Cloud AWS.

Details

Module Info

• Product: Spring Cloud AWS
• Affected packages: io.awspring.cloud:spring-cloud-aws-sns, org.springframework.cloud:spring-cloud-aws-messaging
• Affected versions: >=2.2.0 <=2.2.8 (spring-cloud-aws-messaging), >=3.0.0 <4.0.2 (spring-cloud-aws-sns)
• GitHub repository: https://github.com/awspring/spring-cloud-aws, https://github.com/spring-attic/spring-cloud-aws
• Published packages: https://central.sonatype.com/artifact/io.awspring.cloud/spring-cloud-aws-sns, https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-aws-messaging
• Package manager: Maven
• Fixed in:
• OSS Spring Cloud AWS: 4.0.2
• NES for Spring Cloud AWS: 2.2.9

Vulnerability Info

This Medium-severity vulnerability is found in the io.awspring.cloud:spring-cloud-aws-sns package in multiple versions of Spring Cloud AWS. Affected 2.2.x versions of Spring Cloud AWS carry the same SNS endpoint support, without signature verification, in the org.springframework.cloud:spring-cloud-aws-messaging package. Controllers that use @NotificationMessageMapping, @NotificationSubscriptionMapping or @NotificationUnsubscribeConfirmationMapping receive SNS messages as plain HTTP POST requests. Amazon SNS signs every message it delivers, and a receiver is expected to check that signature against the AWS signing certificate before it trusts the message. Affected versions of Spring Cloud AWS do not perform that check.

AbstractNotificationMessageHandlerMethodArgumentResolver.resolveArgument reads the request body into a JsonNode and passes it straight to the concrete resolver. The resolver for @NotificationMessage parameters only checks the Type field and then converts the attacker-supplied Message field into the handler's parameter:

protected Object doResolveArgumentFromNotificationMessage(JsonNode content, HttpInputMessage request,
		Class<?> parameterType) {
	if (!"Notification".equals(content.get("Type").asString())) {
		throw new IllegalArgumentException(
				"@NotificationMessage annotated parameters are only allowed for method that receive a notification message.");
	}

	MediaType mediaType = getMediaType(content);
	String messageContent = content.findPath("Message").asString();
	for (HttpMessageConverter<?> converter : this.messageConverter) {
		if (converter.canRead(parameterType, mediaType)) {
			try {
				return converter.read((Class) parameterType,
						new ByteArrayHttpInputMessage(messageContent, mediaType, request));
			}
			catch (Exception e) {
				throw new HttpMessageNotReadableException(
						"Error converting notification message with payload:" + messageContent, e, request);
			}
		}
	}
	...
}

The resolver for NotificationStatus parameters does the same for subscription traffic. It accepts any body whose Type is SubscriptionConfirmation or UnsubscribeConfirmation and builds a status object from the unverified TopicArn and Token fields:

protected Object doResolveArgumentFromNotificationMessage(JsonNode content, HttpInputMessage request,
		Class<?> parameterType) {
	if (!"SubscriptionConfirmation".equals(content.get("Type").asString())
			&& !"UnsubscribeConfirmation".equals(content.get("Type").asString())) {
		throw new IllegalArgumentException(
				"NotificationStatus is only available for subscription and unsubscription requests");
	}
	return new AmazonSnsNotificationStatus(this.snsClient, content.get("TopicArn").asString(),
			content.get("Token").asString());
}

When the handler calls notificationStatus.confirmSubscription(), the application calls the SNS ConfirmSubscription API with the attacker's topic ARN and token using its own AWS credentials. Because the Signature, SigningCertURL and SignatureVersion fields are ignored, an attacker who can reach the endpoint can forge notifications that run through the application's business logic, or drive the application to confirm a subscription to a topic the attacker controls.

Mitigation

Only recent versions of Spring Cloud AWS receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Cloud AWS.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.