What is the CVSS score of CVE-2026-59298?

CVE-2026-59298 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Spring Cloud Function CVE-2026-59298

EUVD-2026-67184 LOW

Improper Input Validation (CWE-20)

2026-08-27 vmware

GHSA-mwgg-hfwg-mqmx

Information Disclosure Java Spring Cloud Function

3.1

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

3.1 LOW

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

vuln.today AI

3.1 LOW

Network vector confirmed by HTTP interface; PR:H and UI:R reflect the authenticated, interaction-dependent exploitation path described; low C/I impacts align with header-filtering information disclosure scope.

3.1 AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 20:51 vuln.today

DescriptionCVE.org

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

AnalysisAI

HTTP header filtering deficiency in Spring Cloud Function versions 5.0.0-5.0.3, 4.3.0-4.3.4, 4.2.0-4.2.7, and 3.2.16 and earlier allows network-accessible authenticated attackers - under high-complexity conditions and requiring user interaction - to achieve limited confidentiality and integrity impacts via crafted HTTP headers. Reported by VMware, the flaw scores 3.1 (Low) under CVSS 3.1, with multiple compounding prerequisites that substantially restrict real-world exploitability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following simultaneously: an authenticated session with high-privilege credentials (PR:H per CVSS vector), high attack complexity suggesting non-trivial, specific conditions must be met (AC:H), and a required user interaction (UI:R). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) yields a Low severity score of 3.1, combining four compounding constraints: high attack complexity, high-privilege prerequisites, mandatory user interaction, and limited confidentiality and integrity impacts with no availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	The primary remediation is to upgrade Spring Cloud Function to a version beyond the affected ranges, as directed by the vendor advisory at https://spring.io/security/cve-2026-59298. … Detailed patch versions, workarounds, and compensating controls in full report.