CVE-2026-59304: CWE-843 Type Confusion in Spring Spring Cloud Stream

This vulnerability involves improper caching of the original content type in Spring Cloud Stream's Avro serialization/deserialization mechanism, leading to a type confusion issue (CWE-843). Affected versions include 4.2.0 to 4.2.6, 4.3.0 to 4.3.3, and 5.0.0 to 5.0.2. The CVSS 3.1 score is 3.1 with vector AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N, indicating that exploitation requires network access, high attack complexity, high privileges, and user interaction, with limited confidentiality and integrity impact and no availability impact. No vendor advisory or patch information is currently available.

The vulnerability could allow an attacker with high privileges and user interaction to cause limited confidentiality and integrity impact due to type confusion in content type caching. There is no known impact on availability. Exploitation complexity is high, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting access to trusted users with appropriate privileges and avoid untrusted input that could trigger the vulnerability.