PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-59299 Spring CVE debrief

CVE-2026-59299 is a vulnerability in Spring Cloud Function that can potentially poison the base function through composition lookup. This affects versions 3.2.16 and earlier, 4.2.0 - 4.2.7, 4.3.0 - 4.3.4, and 5.0.0 - 5.0.3. Users should verify their inventory and apply patches or compensating controls as available. The CVE record was published on 2026-08-27T20:17:56.173Z and has not been modified since then. The vulnerability has a CVSS score of 3.1 and is considered low-severity.

Vendor
Spring
Product
Spring Cloud Function
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-27
Original CVE updated
2026-09-02
Advisory published
2026-08-27
Advisory updated
2026-09-02

Who should care

Users of Spring Cloud Function, especially those using affected versions (3.2.16 and earlier, 4.2.0 - 4.2.7, 4.3.0 - 4.3.4, and 5.0.0 - 5.0.3), should verify their inventory and apply patches or compensating controls as available. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact and take necessary actions.

Technical summary

CVE-2026-59299 is a low-severity vulnerability in Spring Cloud Function, affecting versions 3.2.16 and earlier, 4.2.0 - 4.2.7, 4.3.0 - 4.3.4, and 5.0.0 - 5.0.3. The vulnerability is related to composition lookup potentially poisoning the base function. Users of Spring Cloud Function, especially those using affected versions, should verify their inventory and apply patches or compensating controls as available.

Defensive priority

Verify inventory of Spring Cloud Function installations, especially versions 3.2.16 and earlier, 4.2.0 - 4.2.7, 4.3.0 - 4.3.4, and 5.0.0 - 5.0.3, and apply vendor patches or compensating controls as available.

Recommended defensive actions

  • Verify inventory of Spring Cloud Function installations
  • Apply vendor patches or compensating controls as available
  • Monitor for potential exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-59299 record indicates a low-severity vulnerability in Spring Cloud Function, with a CVSS score of 3.1. The vulnerability affects multiple versions of Spring Cloud Function, including 3.2.16 and earlier, 4.2.0 - 4.2.7, 4.3.0 - 4.3.4, and 5.0.0 - 5.0.3. The NVD entry is currently Analyzed.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-59299 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-59299

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-59299 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-59299

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.