CVE-2026-59298: CWE-20 Improper Input Validation in Spring Spring Cloud Function

This vulnerability, identified as CWE-20 (Improper Input Validation), exists in Spring Cloud Function where HTTP headers may not be properly filtered. Affected versions include 3.2.16 and earlier, 4.2.0 to 4.2.7, 4.3.0 to 4.3.4, and 5.0.0 to 5.0.3. The CVSS 3.1 base score is 3.1, indicating low severity, with attack vector network, high attack complexity, requiring high privileges and user interaction, and impacts limited confidentiality and integrity. There is no vendor advisory or patch information available at this time.

The vulnerability could allow an attacker with high privileges and user interaction to cause limited confidentiality and integrity impacts via improper filtering of HTTP headers. There is no impact on availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should be cautious with HTTP header inputs and consider applying any available vendor recommendations once published.