CVE-2019-3799

CVE-2019-3799 - Spring-Cloud-Config-Server Directory Traversal Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the...

spring-cloud__spring-cloud-config_CVE-2020-5410_2-1-8-RELEASE

//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-config/tree/master.svg?style=svg"CircleCI",...

spring-cloud__spring-cloud-config_CVE-2020-5405_2-1-6-RELEASE

//// DO NOT EDIT THIS FILE. IT WAS GENERATED. Manual changes to this file will be lost when it is generated again. Edit the files in the src/main/asciidoc/ directory instead. //// image::https://circleci.com/gh/spring-cloud/spring-cloud-config/tree/master.svg?style=svg"CircleCI",...

ROOT-APP-MAVEN-CVE-2026-22739 CVE-2026-22739 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-22739 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41002 CVE-2026-41002 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-41002 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-40981 CVE-2026-40981 in org.springframework.cloud:spring-cloud-config-server - Patched by Root

Root has patched CVE-2026-40981 in the org.springframework.cloud:spring-cloud-config-server package for Root:Maven. Multiple fixed versions available...

K000163433: Spring Cloud vulnerability CVE-2026-41002

Security Advisory Description The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade ...

Spring Cloud Config Server - Local File Inclusion

Spring Cloud Config Server versions 2.1.x prior to 2.1.2, 2.0.x prior to 2.0.4, 1.4.x prior to 1.4.6, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files. An attacker can send a request using a specially...

CVE-2026-47894

A flaw was found in Spring Cloud Config Server. This vulnerability allows for the exposure of configuration files outside of their intended repository path. An attacker with high privileges could exploit this flaw through the native environment repository, leading to sensitive information...

CVE-2026-47836

A flaw was found in Spring Cloud Config Server. The base directory used by the server to clone SVN repositories is susceptible to a Time-of-Check Time-of-Use TOCTOU attack. A local attacker with high privileges could exploit this vulnerability by manipulating the directory between the security...

CVE-2026-47837

A flaw was found in Spring Cloud Config Server. This vulnerability allows an unauthenticated remote attacker to send webhook requests to the /monitor endpoint without validation. This lack of authentication for a critical function could lead to a denial of service DoS condition, making the server...

Denial-of-Service (DoS)

Spring Cloud Config is vulnerable to a Denial-of-Service DoS. The vulnerability is due to the Spring Cloud Config Monitor processing maliciously crafted payloads, which allows an attacker to send specially crafted requests that can exhaust application resources and cause the affected service to...

Directory Traversal

Spring Cloud Config is vulnerable to Directory Traversal. The vulnerability is due to improper restriction of configuration file access in the native environment repository, which allows an attacker to access configuration files outside the configured repository path...

Missing Authentication

Spring Cloud Config is vulnerable to a Missing Authentication for Critical Function. The vulnerability is due to unvalidated Webhook requests to the Spring Cloud Config Server’s /monitor endpoint, which allows an attacker to send unauthorized requests and potentially trigger protected functionali...

Time-of-Check Time-of-Use (TOCTOU)

Spring Cloud Config is vulnerable to a Time-of-Check Time-of-Use TOCTOU vulnerability. The vulnerability is due to insufficient synchronization between checking and using the SVN repository base directory, which allows an attacker to exploit the time gap to manipulate the directory and potentiall...

CVE-2026-59315

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

CVE-2026-59315

Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Affected versions include Spring Cloud Config 5.0.0–5.0.4, 4.3.0–4.3.4, 4.0.0–4.2.8, and 3.1.14 and earlier . The vulnerability is scored CVSS 5.3 (Medium) with a network attack vector, low complexity,...

CVE-2026-59315 Spring Cloud Config Monitor Denial of Service

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

CVE-2026-59315 Spring Cloud Config Monitor Denial of Service

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...

EUVD-2026-67197

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier...