Executive brief
Spring Cloud Stream is a framework used to build message-driven microservices that process and route data across distributed systems. A vulnerability in the partition interceptor can cause improper handling of messages during transmission, potentially leading to data routing errors or unexpected message loss in message-broker deployments.
Technical details
A partition interceptor may be improperly added during message sending operations in Spring Cloud Stream, affecting versions 4.2.0–4.2.6, 4.3.0–4.3.3, and 5.0.0–5.0.2. The vulnerability is rooted in incorrect interceptor lifecycle management when partitioning messages for distribution across broker partitions. While the attack vector and exploitation complexity are not fully detailed in the advisory, the low CVSS score (3.1) suggests limited practical impact, likely requiring specific application configurations or conditions to trigger. Patches are available in newer versions beyond those listed.
Affected products
- VMware Spring Cloud Stream 4.2.0–4.2.6, 4.3.0–4.3.3, 5.0.0–5.0.2
Timeline
- 2026-08-27: disclosed