CVE-2026-44308 Details
Description
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) did not verify the signature of incoming SNS messages. An unauthenticated attacker who knows the endpoint URL could send crafted HTTP POST requests mimicking SNS Notification or SubscriptionConfirmation messages. This vulnerability is fixed in 4.0.2.
A vulnerability exists in Spring Cloud AWS versions 3.0.0 through 4.0.1, where applications using SNS HTTP/HTTPS endpoint support did not verify the signature of incoming SNS messages. This flaw allows an unauthenticated attacker who knows the endpoint URL to send crafted HTTP POST requests that mimic SNS Notification or SubscriptionConfirmation messages. As a result, the application could process these messages as legitimate, potentially leading to unauthorized confirmation of subscriptions or unsubscription from topics controlled by the attacker.
Users should upgrade to Spring Cloud AWS version 4.0.2, where this vulnerability is fixed. For those on the 3.x line, a manual workaround is available by verifying the SNS message signature in a servlet filter or Spring HandlerInterceptor before the request reaches the controller, using the SnsMessageManager from the AWS SDK v2 sns-message-manager module.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 14, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/awspring/spring-cloud-aws/security/advisories/GHSA-r4w4-wv68-qv85 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Spring Cloud AWS | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |