CVE-2026-59304

Overview

Spring Cloud Stream is a framework for building message-driven microservices on top of Spring Boot and Spring Integration. It provides a binder abstraction that connects application code to messaging middleware such as RabbitMQ, Apache Kafka and Apache Pulsar, so the same business logic can run against different brokers without being rewritten. Its Avro schema registry client adds message converters that resolve and cache the content type of inbound messages.

A Denial of Service (DoS) vulnerability (CVE-2026-59304) has been identified in the Spring Cloud Stream Avro schema registry client, which allows attackers who can vary a message header to grow an in-memory cache without limit until the application exhausts heap.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

This issue affects multiple versions of Spring Cloud Stream. The affected class shipped in the core module during the 1.3 and 2.x lines, was absent from the 3.x lines while the schema registry code lived in a separate project, and returned in the schema registry client from the 4.0.0 release onward.

Details

Module Info

• Product: Spring Cloud Stream
• Affected packages: org.springframework.cloud:spring-cloud-stream, org.springframework.cloud:spring-cloud-stream-schema, org.springframework.cloud:spring-cloud-stream-schema-registry-client
• Affected versions:
• org.springframework.cloud:spring-cloud-stream: >=1.3.0.RELEASE <=1.3.4.RELEASE
• org.springframework.cloud:spring-cloud-stream-schema: >=2.0.0.RELEASE <=2.2.1.RELEASE
• org.springframework.cloud:spring-cloud-stream-schema-registry-client: >=4.0.0 <=4.0.5, >=4.1.0 <=4.1.6, >=4.2.0 <=4.2.3, >=4.3.0 <=4.3.3, >=5.0.0 <5.0.3
• GitHub repository: https://github.com/spring-cloud/spring-cloud-stream
• Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-stream-schema-registry-client
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Cloud Stream: v4.1.9, v4.2.6, and v4.3.5
  • OSS Spring Cloud Stream: 5.0.3

Vulnerability Info

This Low-severity vulnerability is found in the org.springframework.cloud:spring-cloud-stream-schema-registry-client package in the Avro message conversion path of Spring Cloud Stream. OriginalContentTypeResolver memoizes parsed MimeType instances in a map that has no size limit and no eviction policy:

private ConcurrentMap<String, MimeType> mimeTypeCache = new ConcurrentHashMap<>();

The key is the string value of the inbound originalContentType header, falling back to the standard contentType header, both of which travel with the message and are therefore under the control of whoever produced it:

else if (contentType instanceof String valueAsString) {
        mimeType = this.mimeTypeCache.get(contentType);
        if (mimeType == null) {
                mimeType = MimeType.valueOf(valueAsString);
                this.mimeTypeCache.put(valueAsString, mimeType);
        }
}

Every distinct header value adds a permanent entry. The resolver is shared rather than per-message: AbstractAvroMessageConverter constructs one in its constructor and the Avro converter is registered as a singleton bean, so resolve runs on every binder consumer thread against the same map. A producer that sends a stream of messages each carrying a different content type string therefore grows the map for the lifetime of the application until the heap is exhausted, without needing to send a large volume of data.

Exploitation is constrained: the attacker needs the privileges required to publish to the bound destination, the application has to be using the Avro schema registry converters, and the score reflects that narrow path at CVSS 3.1 3.1 (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N).

This vulnerability was introduced in 2017 with Spring Cloud Stream 1.3.0.RELEASE.

Mitigation

Only recent versions of Spring Cloud Stream receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Cloud Stream.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• No finder has been publicly credited for this issue.