Description

Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-27T20:17:56.640Z",
  "pubdate": "2026-08-27T20:17:56.640Z",
  "executiveSummary": "A resource exhaustion vulnerability exists in Spring Cloud Stream due to an unbounded dynamic destination cache.\nThe vulnerability allows an unauthenticated or authenticated attacker to trigger uncontrolled memory consumption by repeatedly requesting operations on new, dynamic destinations.\nThis impacts Spring Cloud Stream versions 5.0.0-5.0.2, 4.3.0-4.3.3, and 4.2.0-4.2.6.\nThe primary risk is a Denial of Service (DoS) condition, where the application becomes unresponsive or crashes due to heap exhaustion.\nExploitation is typically achieved by sending a high volume of requests targeting unique, non-existent destination names, forcing the framework to allocate resources for each entry without a corresponding eviction mechanism.",
  "technicalDetails": "The vulnerability resides within the internal destination management logic of Spring Cloud Stream, specifically where dynamic destinations are cached to facilitate message routing and binding. In the identified affected versions, the framework fails to implement an upper bound or a Least Recently Used (LRU) eviction policy for the internal cache responsible for tracking these dynamic destinations.\nWhen an application processes messages directed at dynamic destinations, the framework instantiates and registers these destinations in a global cache. Because the cache size is not bound, an attacker can programmatically iterate through a large set of unique destination strings. For each unique string provided in a message header or destination-specific trigger, the application performs a lookup, fails to find an existing mapping, and creates a new entry in the underlying Map structure.\nThe attack flow proceeds as follows: First, the attacker identifies an endpoint or message broker input that influences destination resolution. Second, the attacker floods the system with messages or requests using unique, randomized destination identifiers. Third, the application's memory footprint expands as each new destination object, associated metadata, and internal routing structures are allocated in the heap. Finally, as the cache grows unbounded, the Java Virtual Machine (JVM) experiences increased garbage collection pressure, eventually leading to an OutOfMemoryError (OOM) or severe latency degradation, effectively resulting in a denial-of-service condition.\nThe vulnerable component is the destination binding registration logic within the Spring Cloud Stream core library. There are no privilege requirements for this exploit, provided the attacker has network access to the messaging interface or the REST endpoints that trigger these dynamic bindings. Because the application logic treats these dynamic requests as legitimate, the framework performs the full allocation cycle for every malformed or malicious destination identifier submitted. This lack of resource limitation makes the system susceptible to memory exhaustion, which persists until the service is restarted, provided no automatic recovery mechanisms are in place. The complexity of the attack is low, requiring only the ability to supply arbitrary destination names to the routing engine."
}