CVE-2026-59305: CWE-696 Incorrect Behavior Order in Spring Spring Cloud Stream

This vulnerability, identified as CWE-696, affects Spring Cloud Stream in versions 4.2.0 to 4.2.6, 4.3.0 to 4.3.3, and 5.0.0 to 5.0.2. The issue is that the partition interceptor may be added improperly during message sending, which could lead to incorrect behavior in message partitioning. The CVSS 3.1 base score is 3.1, indicating low severity, with network attack vector, high attack complexity, required privileges and user interaction, and limited confidentiality and integrity impact without availability impact. There is no vendor advisory or patch information available, and no known exploits in the wild.

The impact is limited to potential incorrect behavior in message partitioning within affected Spring Cloud Stream versions. Confidentiality and integrity impacts are low, and there is no availability impact. Exploitation requires high complexity, privileges, and user interaction, reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users should monitor vendor communications for updates and consider reviewing message partitioning configurations to detect any anomalies.