CVE-2026-59303: CWE-770 Allocation of Resources Without Limits or Throttling in Spring Spring Cloud Stream

The vulnerability identified as CVE-2026-59303 in Spring Cloud Stream involves improper bounding of the dynamic destination cache size, which constitutes an allocation of resources without limits or throttling (CWE-770). This can cause excessive resource consumption under certain conditions. The affected versions include 4.2.0 to 4.2.6, 4.3.0 to 4.3.3, and 5.0.0 to 5.0.2. The CVSS score is 3.1, indicating low severity, with network attack vector, high attack complexity, requiring privileges and user interaction, and limited impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch information available at this time.

The impact is limited due to the low CVSS score of 3.1. The vulnerability could allow an attacker with high privileges and requiring user interaction to cause resource exhaustion by exploiting the unbounded dynamic destination cache size. This may lead to degraded performance or denial of service conditions indirectly, but no direct availability impact is reported. Confidentiality and integrity impacts are low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published. Users should monitor vendor communications for updates and consider limiting privileges and user interactions as a precaution.