Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the partition interceptor. An attacker can cause unauthorized modification or disclosure of message data by manipulating the message sending process. Remediation Upgrade...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the logging process. An attacker can obtain sensitive information by accessing logs that may inadvertently contain confidential data. Remediation Upgrade...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging. An attacker can access sensitive information by reviewing application logs under certain conditions. Remediation Upgrade org.springframework.cloud:spring-cloud-stream to...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the isSecure function of ServerlessHttpServletRequest due to not verifying the actual scheme. An attacker can potentially access or modify sensitive information by exploiting this improper security che...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' through the composition lookup. An attacker can manipulate the base function by injecting malicious components during the lookup process,...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting in the processing of HTTP headers. An attacker can inject or manipulate HTTP headers by sending specially crafted requests. Remediation Upgrade org.springframework.cloud:spring-cloud-function-web to version 5.0.4...

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint

cve-2026-59284 - HIGH - Spring Cloud Commons no allow list for writable env actuator endpoint...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper restriction of the dynamic destination cache size. An attacker can cause unintended information disclosure or modification by exploiting the lack of proper bounds on t...

Improper Authentication

Spring Cloud Config Server is vulnerable to Improper Authentication. The vulnerability is due to SessionManager persisting the first Vault token and ignoring subsequent X-CONFIG-TOKEN values, causing requests to use a previously stored token instead of the client-supplied token...

Denial-of-service (DoS)

Spring Cloud Sleuth is vulnerable to a Denial-of-service DoS. The vulnerability is due to specially crafted calls that can trigger a DoS condition when org.springframework.cloud:spring-cloud-sleuth-instrumentation is used with Spring TX instrumentation enabled, allowing an attacker to exploit the...

CLSA-2026-1777509591 TuxCare security update for org.springframework.cloud (1 CVE)

TuxCare rebuilt 7 org.springframework.cloud packages to address 1 CVE. Fixed in 3.1.9-tuxcare.2...

This Week in Spring - August 4th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's the 4th of August! We're already in month eight of this year! Great Scott! This is an interesting project to help ensure idempotency keys for Spring Boot requests A very interesting post on The New Stack titled, When...

CVE-2026-40990

A flaw was found in Spring Cloud Function. A local attacker with low privileges could exploit this vulnerability by repeatedly adding functions to the Function Registry, leading to an Out Of Memory OOM error. This resource exhaustion can cause a Denial of Service DoS for the affected application...

The vulnerability of the spring-cloud-azure-starter-active-directory-b2c component of the Microsoft Azure Spring Apps cloud service allows a perpetrator to escalate their privileges.

The vulnerability of the spring-cloud-azure-starter-active-directory-b2c component of the Microsoft Azure Spring Apps cloud service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain increased privileges remotely...

Exploit for CVE-2026-50338

CVE-2026-50338 Spring Cloud Azure B2C Resource Server Cross-I...

K000162233: Spring Framework vulnerability CVE-2026-47825

Security Advisory Description Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x fix 3.1.13. Spring Cloud...

K000162213: Spring Cloud vulnerability CVE-2026-40982

Security Advisory Description Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud...

K000162203: Spring Cloud Config vulnerability CVE-2026-40981

Security Advisory Description When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive;...