com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +36 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.3.1)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =0.0.1, =1.0.0, =3.0.3, =0.5, =0.0.1, =0.1.41-beta, =1.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.1-10, =2026.0-19, =2026.1.3 and more Source cves: CVE-2026-22739 Source advisory:...

org.apereo.cas:cas-server-support-configuration-cloud-amqp (>=8.0.0-rc1, <=8.0.0-rc2), org.apereo.cas:cas-server-webapp-init-config-server (>=8.0.0-rc1, <=8.0.0-rc2) +3 more potentially affected by CVE-2026-22739 via org.springframework.cloud:spring-cloud-config-server (>=5.0.0-m1, <=5.0.1)

org.springframework.cloud:spring-cloud-config-server MAVEN version =5.0.0-m1, =8.0.0-rc1, =8.0.0-rc1, =5.0.0-m1, =5.0.0-m1, =5.0.1 Source cves: CVE-2026-22739 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-15762281...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +90 more potentially affected by CVE-2026-22732 via org.springframework.security:spring-security-web (4.2.5.release)

org.springframework.security:spring-security-web MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...

com.revinate:henicea (>=1.0.0, <=1.1.2), de.codecentric:spring-boot-starter-batch-web (1.3.5.release) +20 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.4.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.revinate:henicea =1.0.0, =0.15.4, =0.15.4...

net.acesinc:convergent-ui (>=1.0.4, <=1.0.6), org.apache.camel:camel-example-spring-boot (2.16.0) +6 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.6.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - net.acesinc:convergent-ui =1.0.4, =1.0.6 -...

com.netflix.spectator:spectator-web-spring (>=0.41.0, <=0.42.0), org.apache.camel:camel-example-spring-boot (>=2.16.3, <=2.16.5) +8 more potentially affected by CVE-2026-22733 via org.springframework.boot:spring-boot-starter-actuator (1.2.8.release)

org.springframework.boot:spring-boot-starter-actuator MAVEN version 1.2.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-starter-actuator and may be impacted: - com.netflix.spectator:spectator-web-spring...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2024-4027 via io.undertow:undertow-core (1.4.23.final)

io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2025-12543 via io.undertow:undertow-core (1.4.23.final)

io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.4.23.final)

io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.4.23.final)

io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...

CVE-2025-22232 Spring Cloud Config Server May Not Use Vault Token Sent By Clients

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...

com.alibaba.cloud:spring-cloud-starter-alibaba-nacos-config-server (>=2020.0.rc1, <=2021.1), com.bpfaas:bps-config-server-novault-spring-cloud-starter (3.2.2) +38 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=3.0.0, <=3.1.9)

org.springframework.cloud:spring-cloud-config-server MAVEN version =3.0.0, =2020.0.rc1, =3.0.0, =2.1.0, =0.1, =0.0.3, =0.8.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =5.79.0, =5.95.0 and more Source cves: CVE-2025-22...

com.mayhoo:config-server (3.0.2), com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=3.0.3, <=3.0.8) +25 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.1.5)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =3.0.3, =0.5, =0.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.1-10, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves: CVE-2025-22232 Source advisory:...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.1)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.1 Source cves: CVE-2025-22232 Source advisory: MEND:CVE-2025-22232...

CVE-2025-22232

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...

CVE-2025-22232: Improper Authentication

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: You have Spring Vault on the classpath of your Spring Cloud Config Server and You are using the...

ai.hyacinth.framework:core-service-config-server (0.5.24), cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release) +62 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=2.2.0.release, <=3.1.9)

org.springframework.cloud:spring-cloud-config-server MAVEN version =2.2.0.release, =2.2.1.release, =0.0.1.release, =0.0.1.release, =1.1.1, =1.0.0, =1.0.0.release, =1.0.1 - com.github.niupengyu:ahead-frame-commons 1.2.5-release - com.github.niupengyu:ahead-frame-core 1.2.5-release -...

com.mayhoo:config-server (3.0.2), com.okta.spring.examples:okta-spring-boot-cloud-config-example (>=3.0.3, <=3.0.8) +25 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=4.0.0, <=4.1.5)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.0.0, =3.0.3, =0.5, =0.0.1, =1.2.1-rc1, =2026.0-19, =2026.0-19, =2026.1-10, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves: CVE-2025-22232 Source advisory:...

com.brihaspathee.artemis:config-server (>=0.0.1, <=1.0.2), com.brihaspathee.sapphire:config-server (>=1.0.0, <=1.0.7) +6 more potentially affected by CVE-2025-22232 via org.springframework.cloud:spring-cloud-config-server (>=4.2.0, <=4.2.1)

org.springframework.cloud:spring-cloud-config-server MAVEN version =4.2.0, =0.0.1, =1.0.0, =3.0.9, =0.1.41-beta, =7.2.0-rc3, =7.2.0-rc3, =4.2.0, =3.2.0, =3.2.1 Source cves: CVE-2025-22232 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-9674187...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +328 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.5.release)

org.springframework.security:spring-security-core MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...