CVE-2026-44308 Spring Cloud AWS: Missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications
Attackers can spoof SNS notifications by bypassing signature verification in Spring Cloud AWS applications using HTTP/HTTPS endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44308?
CVE-2026-44308 is a medium-severity vulnerability in awspring spring-cloud-aws, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) did not verify the signature of incoming SNS messages. An unauthenticated attacker who knows the endpoint URL could send crafted HTTP POST requests mimicking SNS Notification or SubscriptionConfirmation messages. This vulnerability is fixed in 4.0.2.
Weakness: CWE-345
Which versions are affected by CVE-2026-44308?
4 open source packages ship an affected version, including io.awspring.cloud:spring-cloud-aws-sns.
| Package | Affected | Fixed in |
|---|---|---|
io.awspring.cloud:spring-cloud-aws-sns Maven | From 3.0.0 to 3.4.2 | None |
io.awspring.cloud:spring-cloud-aws-sns Maven | From 3.0.0 to 3.4.2 | None |
io.awspring.cloud:spring-cloud-aws-sns Maven | From 4.0.0 | 4.0.2 |
io.awspring.cloud:spring-cloud-aws-sns Maven | From 4.0.0 | 4.0.2 |
How do I fix CVE-2026-44308?
Upgrade io.awspring.cloud:spring-cloud-aws-sns to 4.0.2 or later.
Is CVE-2026-44308 being exploited?
There is no known exploitation of CVE-2026-44308 in the wild and no public exploit code.
Sources
Also known as GHSA-r4w4-wv68-qv85, ROOT-APP-MAVEN-CVE-2026-44308.