Spring Cloud Stream 4.2.x Release Notes

Security Fixes

• Evicting a dynamic destination from StreamBridge's channel cache now also removes its generated binding properties, so the bindings map can no longer grow past the configured cache limit (low severity, CVE-2026-59303).
• Queue and exchange names are now percent-encoded as single path segments by RabbitBindingCleaner, so a crafted name can no longer alter the RabbitMQ management API deletion path it is interpolated into (low severity, CVE-2026-59302).
• Repeated sends to a cached partitioned destination no longer register duplicate DefaultPartitioningInterceptor instances, because FunctionConfiguration now checks the output channel for an existing one before adding another (low severity, CVE-2026-59305).
• OriginalContentTypeResolver now evicts the eldest entry once its parsed MIME type cache exceeds 100 entries, so distinct inbound content type headers can no longer grow it without limit for the resolver's lifetime (low severity, CVE-2026-59304).
• java.net is no longer one of BinderHeaderMapper's default trusted packages, so JSON-encoded Kafka headers naming java.net types are no longer deserialized without an explicit application trust decision (low severity, CVE-2026-59306).

Dependency Upgrades

• Spring Cloud Build (NES) 4.2.4-spring-cloud-build-4.2.7
• Spring Cloud Function (NES) 4.2.4-spring-cloud-function-4.2.8