Executive brief
Spring Cloud Stream is a framework for building event-driven microservices that process data streams. An improper caching issue in its Avro serialization handler could allow attackers to manipulate content type handling in message processing, potentially leading to data misinterpretation or service disruption in applications that rely on this framework for real-time data streaming.
Technical details
The vulnerability stems from improper caching of the original content type in Spring Cloud Stream's Avro serialization/deserialization component. The affected versions cache content type information without proper validation or reset mechanisms, allowing the cached value to persist incorrectly across message processing operations. This could enable an attacker on the network to send specially crafted messages that cause the cached content type to diverge from the actual message content type, resulting in incorrect parsing or processing of subsequent messages. The issue affects multiple versions across Spring Cloud Stream 4.2.x, 4.3.x, and 5.0.x release lines.
Affected products
- VMware Spring Cloud Stream 4.2.0–4.2.6, 4.3.0–4.3.3, 5.0.0–5.0.2
Timeline
- 2026-08-27: disclosed