PT-2026-38403 · Unknown · Spring Cloud Aws

Matej Nedic · Published 2026-05-07 · Updated 2026-05-14 · CVE-2026-44308

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Spring Cloud AWS versions 3.0.0 through 4.0.1

Description Applications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support via @NotificationMessageMapping, @NotificationSubscriptionMapping, or @NotificationUnsubscribeConfirmationMapping do not verify the signature of incoming SNS messages. An unauthenticated attacker with knowledge of the endpoint URL can send crafted HTTP POST requests mimicking SNS Notification or SubscriptionConfirmation messages. This allows the attacker to force the application to process arbitrary payloads as legitimate notifications or auto-confirm subscriptions and unsubscribe from attacker-controlled topics.

Recommendations Versions 3.0.0 through 4.0.1: Upgrade to version 4.0.2. Versions 3.0.0 through 3.4.2: Manually verify the SNS message signature in a servlet filter or Spring HandlerInterceptor using SnsMessageManager before the request reaches the controller.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-44308

GHSA-R4W4-WV68-QV85

Affected Products

Spring Cloud Aws

References · 6

• https://osv.dev/vulnerability/GHSA-r4w4-wv68-qv85 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44308 · Security Note
• https://github.com/awspring/spring-cloud-aws/security/advisories/GHSA-r4w4-wv68-qv85 · Note
• https://github.com/awspring/spring-cloud-aws/pull/1614 · Note
• https://github.com/awspring/spring-cloud-aws/commit/6ab2efd97891a3d0ed0126ffa1ce223c9cfa9638 · Note
• https://github.com/awspring/spring-cloud-aws · Note