Executive brief
Spring Cloud Stream is a framework used to build event-driven microservices that process streaming data. A flaw in how it manages its destination cache allows an attacker to exhaust memory resources by creating new destinations without limit, potentially causing service availability issues or denial of service.
Technical details
The vulnerability is a resource exhaustion issue in Spring Cloud Stream's dynamic destination cache mechanism. The cache lacks proper size bounds, allowing an attacker to continuously create new destination entries that accumulate in memory without eviction or limits. The attack is network-reachable and requires the ability to send messages with different destination names to a Spring Cloud Stream application. Successful exploitation can lead to memory exhaustion and application unavailability. Patches are available in Spring Cloud Stream 4.2.7+, 4.3.4+, and 5.0.3+.
Affected products
- Spring Cloud Stream 4.2.0 - 4.2.6, 4.3.0 - 4.3.3, 5.0.0 - 5.0.2
Timeline
- 2026-08-27: disclosed