{"action":"Upgrade io.awspring.cloud:spring-cloud-aws-sns to 4.0.2 or later.","affected":[{"fixed":"4.0.2","introduced":"4.0.0"},{"introduced":"3.0.0","last_affected":"3.4.2"}],"component":"io.awspring.cloud:spring-cloud-aws-sns","cve_ids":["CVE-2026-44308"],"ecosystem":"Maven","epss":0.00179,"exploited":false,"fixed_versions":["4.0.2"],"ghsa_id":"GHSA-r4w4-wv68-qv85","id":"tcs_01M5N9AYF11JKBQPM874RDSQDB","modified_at":"2026-05-14T21:05:12.920012Z","published_at":"2026-05-07T00:06:52Z","references":["https://osv.dev/vulnerability/GHSA-r4w4-wv68-qv85","https://github.com/awspring/spring-cloud-aws/security/advisories/GHSA-r4w4-wv68-qv85","https://nvd.nist.gov/vuln/detail/CVE-2026-44308","https://github.com/awspring/spring-cloud-aws/pull/1614","https://github.com/awspring/spring-cloud-aws/commit/6ab2efd97891a3d0ed0126ffa1ce223c9cfa9638","https://github.com/awspring/spring-cloud-aws"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-r4w4-wv68-qv85","url":"https://osv.dev/vulnerability/GHSA-r4w4-wv68-qv85"}],"summary":"Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications"}