CVE-2026-44308 json
Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications
published 2026-05-07 6 mo ago modified 2026-10-26 14 d ago also GHSA-r4w4-wv68-qv85 , EUVD-2026-30302
- cvss
- 6.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 7%
- public exploits
- 0
- none known
Summary
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) did not verify the signature of incoming SNS messages. An unauthenticated attacker who knows the endpoint URL could send crafted HTTP POST requests mimicking SNS Notification or SubscriptionConfirmation messages. This vulnerability is fixed in 4.0.2.
Patch / fix
- maven io.awspring.cloud:spring-cloud-aws-sns 4.0.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.awspring.cloud:spring-cloud-aws-sns | >=4.0.0, <4.0.2 >=3.0.0, <=3.4.2 |
4.0.2 |
Affected products
- awspring spring-cloud-aws
- io.awspring.cloud spring-cloud-aws-sns
Classification
- Weakness
-
- CWE-345 Insufficient Verification of Data Authenticity
References
-
github.com
/awspring/spring-cloud-aws/pull/1614
web
-
github.com
/awspring/spring-cloud-aws/commit/6ab2efd97891a3d0ed0126ffa1ce223c9cfa9638
web
-
github.com
/awspring/spring-cloud-aws/security/advisories/GHSA-r4w4-wv68-qv85
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-44308
advisory
-
github.com
/awspring/spring-cloud-aws
package
Sources
- CVE List CVE-2026-44308
- GitHub Advisory GHSA-r4w4-wv68-qv85
- NVD CVE-2026-44308
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.