Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging process. An attacker can access sensitive information by triggering specific log events under certain conditions. Remediation Upgrade...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the logging process. An attacker can obtain sensitive information by accessing logs that may inadvertently contain confidential data. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the process that handles incoming payloads. An attacker can cause service disruption by sending specially crafted malicious payloads. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper restriction of the dynamic destination cache size. An attacker can cause unintended information disclosure or modification by exploiting the lack of proper bounds on t...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the isSecure function of ServerlessHttpServletRequest due to not verifying the actual scheme. An attacker can potentially access or modify sensitive information by exploiting this improper security che...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the partition interceptor. An attacker can cause unauthorized modification or disclosure of message data by manipulating the message sending process. Remediation Upgrade...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' through the composition lookup. An attacker can manipulate the base function by injecting malicious components during the lookup process,...

Missing Authentication for Critical Function

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the monitor endpoint, which does not validate incomi...

cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN

cve-2026-47836 - HIGH - Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN...

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

cve-2026-47837 - MEDIUM - Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests...

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure

cve-2026-47894 - MEDIUM - Spring Cloud Config Server Native Environment Repository Exposure...

org.springframework.cloud:spring-cloud-stream-schema-registry-server (>=4.2.2, <=5.0.2) potentially affected by CVE-2026-59304 via org.springframework.cloud:spring-cloud-stream-schema-registry-core (>=4.2.2, <=5.0.2)

org.springframework.cloud:spring-cloud-stream-schema-registry-core MAVEN version =4.2.2, =4.2.2, =5.0.2 Source cves: CVE-2026-59304 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267416...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting in the processing of HTTP headers. An attacker can inject or manipulate HTTP headers by sending specially crafted requests. Remediation Upgrade org.springframework.cloud:spring-cloud-function-web to version 5.0.4...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging. An attacker can access sensitive information by reviewing application logs under certain conditions. Remediation Upgrade org.springframework.cloud:spring-cloud-stream to...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the function that processes input data. An attacker can access arbitrary files or make unauthorized network requests by supplying crafted input that is improperly handled. Remediation Upgrade...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=9.3.0) +466 more potentially affected by CVE-2026-59303 via org.springframework.cloud:spring-cloud-stream (>=4.2.0, <=5.0.2)

org.springframework.cloud:spring-cloud-stream MAVEN version =4.2.0, =17.16.0, =5.0.5, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =3.5.5.2 and more Source cves: CVE-2026-59303https://vulners.com/cve/C...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=9.3.0) +466 more potentially affected by CVE-2026-59305 via org.springframework.cloud:spring-cloud-stream (>=4.2.0, <=5.0.2)

org.springframework.cloud:spring-cloud-stream MAVEN version =4.2.0, =17.16.0, =5.0.5, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =3.5.5.2 and more Source cves: CVE-2026-59305https://vulners.com/cve/C...

io.github.shuigedeng:taotao-cloud-demo (2025.12), io.github.shuigedeng:taotao-cloud-starter-alibaba (2025.12) +38 more potentially affected by CVE-2026-59298 via org.springframework.cloud:spring-cloud-function-web (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-web MAVEN version =5.0.0-m1, =0.27.2, =0.27.2, =0.33.2, =0.33.2, =0.43.0 and more Source cves: CVE-2026-59298 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267406...