# CVE-2026-59297: Spring Cloud Function isSecure() implementation does not verify HTTPS scheme

Source: https://junglewise.ai/threats/cve-2026-59297-spring-cloud-function-issecure-implementation-does-not-verify  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-59297 · Severity: low · CVSS 3.1 · Published 2026-08-27

Spring Cloud Function is used to build serverless applications that process HTTP requests. A flaw in the isSecure() method of ServerlessHttpServletRequest causes it to incorrectly report whether a request was made over HTTPS, potentially allowing attackers to bypass security checks that rely on verifying encrypted connections. This could lead to sensitive data being transmitted insecurely or security policies being circumvented.

Technologies: [Spring Cloud Function](https://junglewise.ai/threats/technologies/cloud-function). Vendors: [Spring](https://junglewise.ai/threats/vendors/spring).

## Quick answers

**Is CVE-2026-59297 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59297 being exploited in the wild.

**How severe is CVE-2026-59297?** Low severity, with a CVSS score of 3.1, published 27 August 2026.

**Which products and versions are affected?** Spring Cloud Function 4.2.0 to 4.2.7, 4.3.0 to 4.3.4, 5.0.0 to 5.0.3.

**Is there a fix for CVE-2026-59297?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59297 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59297?** Check whether you run Spring Cloud Function at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ServerlessHttpServletRequest class in Spring Cloud Function versions 4.2.0–4.2.7, 4.3.0–4.3.4, and 5.0.0–5.0.3 implements an isSecure() method that fails to properly verify the actual HTTP scheme (http vs. https). This is a logic flaw in the request validation layer. The vulnerability allows an attacker with network access to a Spring Cloud Function endpoint to make requests that are falsely reported as secure, potentially bypassing downstream security controls that check request.isSecure(). No special authentication or user interaction is required. Patches are available in newer versions of Spring Cloud Function.

## Affected products

- Spring Cloud Function 4.2.0 to 4.2.7, 4.3.0 to 4.3.4, 5.0.0 to 5.0.3

## Timeline

- 2026-08-27: disclosed

## References

- [https://spring.io/security/cve-2026-59297](https://spring.io/security/cve-2026-59297)

## Related threats

- [Spring Cloud Function composition lookup function poisoning](https://junglewise.ai/threats/cve-2026-59299-spring-cloud-function-composition-lookup-function-poisoning)
- [Spring Cloud Function improper HTTP header filtering](https://junglewise.ai/threats/cve-2026-59298-spring-cloud-function-improper-http-header-filtering)