Spring Cloud Stream CVE-2026-59304

Exploitation requires all of the following conditions simultaneously: (1) the target application uses Spring Cloud Stream with the Avro binder component enabled - deployments using JSON, Protobuf, or other serializers are not affected; (2) the attacker must hold high-privilege access (PR:H per CVSS), meaning they must be authenticated with elevated rights over the messaging infrastructure or application configuration; (3) high attack complexity (AC:H) implies specific timing or sequencing conditions must be met; (4) user interaction (UI:R) is required, meaning a legitimate privileged user must take some action to trigger the flawed code path. The absence of any of these conditions prevents exploitation. Non-Avro deployments of Spring Cloud Stream are not affected.

The overall risk is low. The CVSS 3.1 base score of 3.1 reflects a combination of high attack complexity (AC:H), high privileges required (PR:H), required user interaction (UI:R), and limited confidentiality and integrity impact (C:L/I:L) with no availability impact. EPSS data is not provided; given the niche conditions required, exploitation probability is expected to be very low - even a mid-sized deployment team responsible for dozens of Spring microservices would face significant barriers to being targeted by this flaw. No CISA KEV listing and no public proof-of-concept code have been identified. The network attack vector (AV:N) is the only signal that might inflate perceived risk; however, the high-privilege and user-interaction prerequisites substantially constrain who can trigger the condition. SSVC signals: exploitation status is none, the vulnerability is not readily automatable due to AC:H and PR:H, and the technical impact is partial. This is a low-priority issue for most organizations - the primary concern is correctness of Avro message pipelines rather than active attacker exploitation.

An attacker or privileged insider with the ability to publish messages to a Spring Cloud Stream Avro-enabled topic, and who can influence a downstream consumer interaction (user interaction required), could craft a sequence of messages that causes the Avro binder to cache and propagate an incorrect content-type header. This could lead to minor information leakage of internal type metadata or cause a consumer to mis-route or mishandle a subsequent message. No public exploit code exists at time of analysis, so exploitation would require custom tooling and deep knowledge of the target's message pipeline.