VMware Spring Cloud Stream vulnerabilities

4 CVEs affecting VMware Spring Cloud Stream, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59306, published 2026-08-27.

More from VMware.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-59306, published 2026-08-27. Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days. Potential for deserialization of untrusted types in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
• CVE-2026-59305, published 2026-08-27. Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days. Partition interceptor may be improperly added while sending message. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
• CVE-2026-59304, published 2026-08-27. Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days. Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
• CVE-2026-59303, published 2026-08-27. Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days. Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6