Executive brief
Spring Cloud AWS is a library that helps Java applications integrate with Amazon Web Services. A security flaw in its Simple Notification Service (SNS) component allows attackers to send fake notifications to an application. This could lead to the application processing fraudulent data, or being tricked into subscribing to or unsubscribing from messaging topics without authorization.
Technical details
Spring Cloud AWS SNS fails to verify the cryptographic signatures of incoming HTTP/HTTPS messages when using @NotificationMessageMapping, @NotificationSubscriptionMapping, or @NotificationUnsubscribeConfirmationMapping. An unauthenticated remote attacker who knows the endpoint URL can send crafted HTTP POST requests that mimic legitimate SNS notifications or subscription confirmations. This allows for the injection of arbitrary payloads or unauthorized subscription management. The vulnerability is fixed in version 4.0.2, where signature verification is enabled by default in Spring Boot auto-configuration. Users on the 3.x branch must manually implement signature verification using SnsMessageManager or upgrade to the 4.x line.
Affected products
- awspring spring-cloud-aws-sns 3.0.0 through 3.4.2, 4.0.0, 4.0.1
Timeline
- 2026-04-30: disclosed: Vulnerability reported to maintainers
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-14: patched: NVD publication and patch availability confirmed