CVE-2026-44308 is a vulnerability in spring-cloud-aws affecting versions 3.0.0 through 4.0.1 where the framework did not verify the authenticity of incoming SNS messages on HTTP/HTTPS endpoints annotated with @NotificationMessageMapping, @NotificationSubscriptionMapping, and @NotificationUnsubscribeConfirmationMapping. This insufficient verification (CWE-345) allows unauthenticated attackers to send forged SNS messages to the application endpoints. The issue is resolved in version 4.0.2.

An attacker who knows the SNS HTTP/HTTPS endpoint URL can send crafted messages that the application may accept as legitimate SNS notifications or subscription confirmations. This could lead to unauthorized processing of fake SNS messages. There are no known exploits in the wild. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality and integrity.

A patch is available in spring-cloud-aws version 4.0.2 that fixes this vulnerability by verifying SNS message signatures. Users should upgrade to version 4.0.2 or later. Since this is a library used in applications, updating the dependency and redeploying the application is required. As this is not a cloud service managed by the vendor, remediation depends on the user applying the patch.