cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.4.23.final)

io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...

Linux Distros Unpatched Vulnerability : CVE-2025-22232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected...

be.atbash.config:atbash-config-client (0.9.1), be.atbash.config:config-server (>=0.9.0, <=0.9.1) +18 more potentially affected by CVE-2025-53864 via com.nimbusds:nimbus-jose-jwt (5.7)

com.nimbusds:nimbus-jose-jwt MAVEN version 5.7 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - be.atbash.config:atbash-config-client 0.9.1 - be.atbash.config:config-server =0.9.0, =0.3, =0.3, =0.3,...

CVE-2025-22232 Spring Cloud Config Server May Not Use Vault Token Sent By Clients

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2020.0.rc1, <=2021.1), com.bpfaas:bps-config-server-novault-spring-cloud-starter (3.2.2) +38 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=3.0.0, <=3.1.9)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.0.0, =2020.0.rc1, =3.0.0, =2.1.0, =0.1, =0.0.3, =0.8.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =5.79.0, =5.95.0 and more Source cves: CVE-2025-22...

com.mayhoo:config-server (3.0.2), com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=3.0.3, <=3.0.8) +27 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.1.5)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =3.0.3, =0.5, =0.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves: CVE-2025-22232 Source advisory:...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.1)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.1 Source cves: CVE-2025-22232 Source advisory: MEND:CVE-2025-22232...

CVE-2025-22232

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...

CVE-2025-22232: Improper Authentication

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...

Spring Cloud Config Server May Not Use Vault Token Sent By Clients

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: In this case the SessionManager persists the first token it retrieves and will continue to use that...

Improper Authorization

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Improper Authorization due to not using the Vault token sent by clients using a X-CONFIG-TOKEN header...

ai.hyacinth.framework:core-service-config-server (0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +62 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.release, <=3.1.9)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.release, =2.2.1.release, =0.0.1.release, =0.0.1-release, =1.1.1, =1.0.0, =1.0.0.release, =1.0.1 - com.github.niupengyu:ahead-frame-commons 1.2.5-release - com.github.niupengyu:ahead-frame-core 1.2.5-release -...

com.mayhoo:config-server (3.0.2), com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=3.0.3, <=3.0.8) +27 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.1.5)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =3.0.3, =0.5, =0.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves: CVE-2025-22232 Source advisory:...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.1)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.1 Source cves: CVE-2025-22232 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-9674187...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +328 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.5.release)

org.springframework.security:spring-security-core MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...

cn.home1:spring-cloud-config-monitor (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1) +326 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.12.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - cn.home1:spring-cloud-config-monitor =0.0.1, =0.0.1, =0.0.1,...

Security Bypass With Wildcard Pattern Matching on Cloud Foundry

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are true: NOTE:...

Malicious code in node-config-server-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26a77c066606c4a4a84afcd49a13b450d6d65f2d7f351ff6d37d75743c5e1792 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2021-3859 via io.undertow:undertow-core (1.4.23.final)

io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2021-3629 via io.undertow:undertow-core (1.4.23.final)

io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...