EUVD-2026-66637

The base directory spring.cloud.config.server.svn.basedir used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring...

PT-2026-82232

Name of the Vulnerable Software and Affected Versions Spring Spring Cloud Config versions 3.x through 3.1.14 Spring Spring Cloud Config versions 4.0.0 through 4.2.8 Spring Spring Cloud Config versions 4.3.0 through 4.3.4 Spring Spring Cloud Config versions 5.0.0 through 5.0.4 Description Missing...

CVE-2026-47837: Missing Authentication for Critical Function

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-47836: Undefined Security Weakness

The base directory spring.cloud.config.server.svn.basedir used by the Spring Cloud Config Server to clone SVN repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring...

PT-2026-82231

Name of the Vulnerable Software and Affected Versions Spring Cloud Config versions 5.0.0 through 5.0.4 Spring Cloud Config versions 4.3.0 through 4.3.4 Spring Cloud Config versions 4.0.0 through 4.2.8 Spring Cloud Config versions 3.1.14 and earlier Description The base directory used by the Sprin...

This Week in Spring - August 25th, 2026

Hi, Spring fans! Welcome back to another installment of This Week in Spring. It’s a big week ahead: I’m about to head out on a packed tour through Europe—Wrocław for a friend’s wedding, Oslo for JavaZone, Paris for a Spring meetup details coming soon, Amsterdam for IntelliJ IDEA conf—and then on ...

Exploit for Code Injection in Vmware Spring_Cloud_Function

No d...

CVE-2026-59291

CVE-2026-59291...

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint...

cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN...

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests...

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization. An attacker can execute arbitrary code or manipulate application behavior by supplying specially crafted input that is deserialized without proper validation. Details Serializati...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the env actuator endpoint when no allow list is enforced for property keys. An attacker can modify arbitrary environment properties by sending crafted requests to the writable endpoint. Note: This is only...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the process that handles incoming payloads. An attacker can cause service disruption by sending specially crafted malicious payloads. Remediation Upgrade...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the logging process. An attacker can obtain sensitive information by accessing logs that may inadvertently contain confidential data. Remediation Upgrade...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging. An attacker can access sensitive information by reviewing application logs under certain conditions. Remediation Upgrade org.springframework.cloud:spring-cloud-stream to...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging process. An attacker can access sensitive information by triggering specific log events under certain conditions. Remediation Upgrade...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the partition interceptor. An attacker can cause unauthorized modification or disclosure of message data by manipulating the message sending process. Remediation Upgrade...