CVE-2026-59306

Overview

Spring Cloud Stream is a framework for building message-driven microservices on top of Spring Boot and Spring Integration. It provides a binder abstraction that connects application code to messaging middleware such as RabbitMQ, Apache Kafka and Apache Pulsar, so the same business logic can run against different brokers without being rewritten. Its Kafka binder maps Kafka record headers to and from Spring messaging headers, deserializing JSON-encoded header values against an allow-list of trusted packages.

An access control configuration vulnerability (CVE-2026-59306) has been identified in the Spring Cloud Stream Kafka binder, which allows attackers who can publish Kafka records to have header values deserialized into java.net types that the trusted-package check was intended to reject.

Per OWASP: Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations.

This issue affects multiple versions of Spring Cloud Stream, beginning with the release that reintroduced the binder header mapper with java.net in its default allow-list.

Details

Module Info

• Product: Spring Cloud Stream
• Affected packages:
  • org.springframework.cloud:spring-cloud-stream-binder-kafka
  • org.springframework.cloud:spring-cloud-stream-binder-kafka-core
• Affected versions:
  • org.springframework.cloud:spring-cloud-stream-binder-kafka: >=3.0.0.RELEASE <=3.0.13.RELEASE, >=3.1.0 <=3.1.6, >=3.2.0 <=3.2.10, >=4.0.0 <=4.0.5, >=4.1.0 <=4.1.6
  • org.springframework.cloud:spring-cloud-stream-binder-kafka-core: >=4.2.0 <=4.2.3, >=4.3.0 <=4.3.3, >=5.0.0 <5.0.3
• GitHub repository: https://github.com/spring-cloud/spring-cloud-stream
• Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-stream-binder-kafka
• Package manager: Maven
• Fixed in: NES for Spring Cloud Stream v3.1.9, v3.2.15, v4.1.9, v4.2.6 and v4.3.5

Vulnerability Info

This Low-severity vulnerability is found in the Kafka binder packages in multiple versions of Spring Cloud Stream. BinderHeaderMapper deserializes JSON-encoded Kafka header values and screens the declared type against a list of package prefixes it is willing to instantiate. That default list includes java.net:

private static final List<String> DEFAULT_TRUSTED_PACKAGES =
		Arrays.asList(
				"java.lang",
				"java.net",
				"java.util",
				"org.springframework.util"
		);

The list is copied into the mapper's mutable trusted-package set at construction, so an application that never configures trusted packages explicitly inherits java.net as an accepted prefix. Any type in that package named by an inbound header therefore passes the check and is constructed during header mapping, on data supplied by whoever produced the record. java.net types are not inert values: constructing and comparing them can reach name resolution and network-facing behavior, which is why the package does not belong in a default allow-list alongside java.lang and java.util.

The vulnerable list lives in the spring-cloud-stream-binder-kafka artifact through the 4.1 line, and moved into spring-cloud-stream-binder-kafka-core from the 4.2.0 release, where the shared mapper is now declared.

Exploitation is constrained: the attacker needs the privileges required to publish records to a bound topic, the application must rely on the default trusted-package configuration, and the vendor score is CVSS 3.1 3.1 (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N).

This vulnerability was introduced in 2019 with Spring Cloud Stream 3.0.0.RELEASE.

Mitigation

Only recent versions of Spring Cloud Stream receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Cloud Stream.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• No finder has been publicly credited for this issue.