org.springframework.cloud:spring-cloud-config-monitor (1.3.4.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.3.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.apereo.cas:cas-management-webapp (>=5.0.0.rc3, <=5.0.1), org.apereo.cas:cas-management-webapp-support (>=5.0.0.rc3, <=5.0.1) +103 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.2.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - org.apereo.cas:cas-management-webapp =5.0.0.rc3...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.1.3.release, <=2.1.4.release), org.springframework.cloud:spring-cloud-config-monitor (2.1.9.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.9.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.springframework.cloud:spring-cloud-config-monitor (2.1.6.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.6.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

Spring Cloud Config Server Susceptible To TOCTOU Attack

The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. - Spring Cloud Config 3.0.x: affected from 3.0.0 through 3.0.7 inclusive; no open-source upgrade available. -...

org.springframework.cloud:spring-cloud-config-monitor (1.4.6.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.4.6.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.2.7.release, <=2.2.8.release), com.buession.springcloud:buession-springcloud-config-server (>=1.3.0, <=2.3.3) +19 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.8.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

ai.hyacinth.framework:core-service-config-server (0.5.0), org.springframework.cloud.stream.app:spring-cloud-stream-app-starters-docs (>=einstein.sr1, <=einstein.sr3) +2 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...

com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=1.0.0, <=1.1.0), com.yoozoo.protoconf:protoconf-java (>=0.2.2, <=0.2.3) +4 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.2.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (>=2.0.0.release, <=2.0.1.release), com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2.0.2.release, <=2.0.4.release) +1 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.5.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.3 Source cves: CVE-2026-40982 Source advisory: GHSA-6G23-24MC-HX6X...

ai.hyacinth.framework:core-service-config-server (0.5.24), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (2.2.0.release) +6 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...

cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.2.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - cn.home1:oss-configserver =1.0.6.oss, =1.0.7.os...

cn.ipokerface:spring-cloud-config-server (1.0.0), com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (2.2.1.release) +26 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.2.2.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - cn.ipokerface:spring-cloud-config-server 1.0.0 ...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2020.0.rc1, <=2021.1), com.bpfaas:bps-config-server-novault-spring-cloud-starter (3.2.2) +38 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=3.0.0, <=3.1.10)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.0.0, =2020.0.rc1, =3.0.0, =2.1.0, =0.1, =0.0.3, =0.8.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =5.79.0, =5.95.0 and more Source cves: CVE-2026-4...

org.springframework.cloud:spring-cloud-alibaba-nacos-config-server (0.2.2.release), org.springframework.cloud:spring-cloud-config-monitor (2.0.3.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.0.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.springframework.cloud:spring-cloud-config-monitor (1.4.7.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.4.7.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (2.1.2.release), org.springframework.cloud:spring-cloud-config-monitor (2.1.7.release) potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (2.1.7.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.3.0-rc1, <=5.3.0-rc3), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=5.3.0-rc4, <=5.3.16) +3 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (1.4.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

GHSA-6G23-24MC-HX6X Spring Cloud Config vulnerable to Path Traversal

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from...