io.github.ilyaslabs.foodstack:configserver (0.0.1), io.github.ilyaslabs:spring-boot-microservice-config-server (1.0.0) +9 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.3.0, =1.0.1, =7.3.0-rc2, =7.3.0-rc2, =26.01.01, =2.3.0, =4.3.0, =3.3.0, =3.3.2 - team.isaz.ark4test.cfgguard:config-guard-starter 1.0.0 - team.isaz.ark4test.cfgguard:config-guard-testkit 1.0.0 Source cves: CVE-2026-40982 Source...

CVE-2026-40982: Improper Limitation of a Pathname to a Restricted Directory

Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +36 more potentially affected by CVE-2026-40981 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =0.0.1, =1.0.0, =3.0.3, =0.5, =0.0.1, =0.1.41-beta, =1.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.1-10, =2026.0-19, =2026.1.3 and more Source cves: CVE-2026-40981 Source advisory:...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +36 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =0.0.1, =1.0.0, =3.0.3, =0.5, =0.0.1, =0.1.41-beta, =1.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.1-10, =2026.0-19, =2026.1.3 and more Source cves: CVE-2026-40982 Source advisory:...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +3 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.1 Source cves: CVE-2026-41002 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-16439108...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +36 more potentially affected by CVE-2026-41004 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =0.0.1, =1.0.0, =3.0.3, =0.5, =0.0.1, =0.1.41-beta, =1.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.1-10, =2026.0-19, =2026.1.3 and more Source cves: CVE-2026-41004 Source advisory:...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +3 more potentially affected by CVE-2026-40981 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.1 Source cves: CVE-2026-40981 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-16439020...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +3 more potentially affected by CVE-2026-41004 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.1 Source cves: CVE-2026-41004 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-16439025...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +36 more potentially affected by CVE-2026-41002 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.3.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =0.0.1, =1.0.0, =3.0.3, =0.5, =0.0.1, =0.1.41-beta, =1.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.1-10, =2026.0-19, =2026.1.3 and more Source cves: CVE-2026-41002 Source advisory:...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc4), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc4) +3 more potentially affected by CVE-2026-40982 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.2)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.1 Source cves: CVE-2026-40982 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-16439043...

org.springframework.cloud:spring-cloud-config-monitor (1.4.5.release) potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.4.5.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

ai.hyacinth.framework:core-service-config-server (0.5.24), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (2.2.0.release) +6 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (2.2.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.2.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...

io.choerodon:choerodon-starter-config-monitor (>=0.5.0.release, <=0.6.4.release), org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.2.0, <=5.2.9) +2 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.3.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.3.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - io.choerodon:choerodon-starter-config-monitor...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.3 Source cves: CVE-2026-22739 Source advisory: GHSA-3QWQ-Q9VM-5J42...

ai.hyacinth.framework:core-service-config-server (>=0.5.8, <=0.5.21), com.alibaba.cloud:spring-cloud-alibaba-nacos-config-server (2.1.1.release) +10 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (2.1.4.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 2.1.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - ai.hyacinth.framework:core-service-config-serve...

com.ixortalk:ixortalk-test (>=1.0.0, <=1.1.3), com.thinkbiganalytics.kylo.plugins:kylo-hadoop-authorization-ranger (>=0.8.3, <=0.9.1) +105 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.1.3.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - com.ixortalk:ixortalk-test =1.0.0, =0.8.3,...

cn.home1:oss-configserver (>=1.0.6.oss, <=1.0.7.oss) potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.2.1.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: - cn.home1:oss-configserver =1.0.6.oss, =1.0.7.os...

org.apereo.cas:cas-server-core-configuration-cloud-amqp (>=5.3.0-rc1, <=5.3.0-rc3), org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=5.3.0-rc4, <=5.3.16) +3 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.4.0.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.springframework.cloud:spring-cloud-config-monitor (1.4.2.release) potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.4.2.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...

org.springframework.cloud:spring-cloud-config-monitor (1.4.6.release) potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (1.4.6.release)

org.springframework.cloud:spring-cloud-config-server MAVEN version 1.4.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-config-server and may be impacted: -...