Cloudfoundry Cf-deployment vulnerabilities

• cloudfoundry routing release, cloudfoundry foundation cf deployment, cloudfoundry cf-deployment +2 more Route Services Firewall Bypass CVE-2026-22726 5.0 MediumApril 30, 2026
• cloudfoundry foundation uaa, cloudfoundry cf-deployment, uaa-release +2 more UAA User Token Revocation logic error CVE-2026-22723 Fix available 6.5 MediumMarch 5, 2026
• cloud foundry uaa, cloudfoundry uaa release, cloud foundry cf deployment +1 more +3 more CVE-2025-22246 – UAA Private Key Exposure CVE-2025-22246 3.0 LowMay 13, 2025
• cloud foundry routing release, cloudfoundry cf-deployment +1 more GoRouter Denial of Service Attack CVE-2024-22279 5.9 MediumJune 10, 2024
• cloud foundry routing, cf deployment, cloudfoundry cf-deployment +1 more +3 more CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter CVE-2023-34041 5.3 MediumSeptember 8, 2023
• cloudfoundry routing release, cf-deployment +1 more In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter... CVE-2023-20882 5.9 MediumMay 26, 2023
• cloudfoundry loggregator-agent, capi-release, cf-deployment +2 more Cloud foundry instances having CAPI version between 1.140 and 1.152.0 along with loggregator... CVE-2023-20881 8.1 HighMay 19, 2023
• cloudfoundry diego, cf-deployment +1 more Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up... CVE-2022-31733 9.1 CriticalFebruary 3, 2023
• cloudfoundry capi-release, cf-deployment +1 more In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer... CVE-2021-22100 5.3 MediumMarch 25, 2022
• cloudfoundry capi-release, cf-deployment +1 more Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service... CVE-2021-22101 7.5 HighOctober 27, 2021
• cloudfoundry cf-deployment, user account and authentication +1 more UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious... CVE-2021-22098 6.1 MediumAugust 11, 2021
• cloudfoundry cf-deployment, user account and authentication +1 more In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was... CVE-2021-22001 7.5 HighJuly 22, 2021
• cloudfoundry capi-release, cf-deployment +1 more Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default... CVE-2021-22115 6.5 MediumApril 8, 2021
• cloud foundry capi, cf deployment, cloudfoundry capi-release +1 more +3 more Cloud Controller is vulnerable to denial of service via YAML parsing CVE-2020-5423 7.5 HighDecember 2, 2020
• cloud foundry routing, cloudfoundry gorouter, cloud foundry cf deployment +1 more +3 more Gorouter is vulnerable to DoS attack via invalid HTTP responses CVE-2020-5420 7.7 HighSeptember 3, 2020
• cloud foundry capi, cf deployment, cloudfoundry capi-release +1 more +3 more Cloud Controller allows users with no roles to list droplets CVE-2020-5418 3.1 LowSeptember 3, 2020
• cloud foundry capi, cf deployment, cloudfoundry capi-release +1 more +3 more Cloud Controller may allow developers to claim sensitive routes CVE-2020-5417 8.5 HighAugust 21, 2020
• cloud foundry routing, cf deployment, cloudfoundry cf-deployment +1 more +3 more CF clusters with NGINX in front of them may be vulnerable to DoS CVE-2020-5416 7.7 HighAugust 21, 2020
• golang go, cloudfoundry cf-deployment, routing-release +3 more +5 more Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as... CVE-2020-15586 Fix available 5.9 MediumJuly 17, 2020
• cloud foundry uaa, cloudfoundry cf-deployment, user account and authentication +2 more UAA fails to check the state parameter when authenticating with external IDPs CVE-2020-5402 8.8 HighFebruary 27, 2020
• cloud foundry capi, cloudfoundry capi-release, cf-deployment +2 more Cloud Controller logs environment variables from app manifests CVE-2020-5400 8.0 HighFebruary 27, 2020
• cloud foundry capi, cloudfoundry capi-release, cf-deployment +2 more CAPI leaks service broker URLs and GUIDs to space developers CVE-2019-11294 4.3 MediumDecember 19, 2019
• cloud foundry uaa release, cloudfoundry cf-deployment, user account and authentication +2 more UAA logs all query parameters with debug logging level CVE-2019-11293 8.8 HighDecember 6, 2019
• cloud foundry uaa release, cloudfoundry cf-deployment, user account and authentication +2 more Cloud Foundry UAA logs query parameters in tomcat access file CVE-2019-11290 8.8 HighNovember 25, 2019
• cloud foundry routing, cloudfoundry cf-deployment, routing-release +2 more A forged route service request using an invalid nonce can cause the gorouter to panic and crash CVE-2019-11289 Fix available 8.6 HighNovember 19, 2019
• cloud foundry smb volume, pivotal software cloud foundry smb volume, cloud foundry cf deployment +1 more +3 more Password leak in smbdriver logs CVE-2019-11283 8.8 HighOctober 23, 2019
• pivotal software cloud foundry uaa, cloud foundry cf deployment, uaa release +1 more +3 more UAA is vulnerable to a Blind SCIM injection leading to information disclosure CVE-2019-11282 4.3 MediumOctober 23, 2019
• cloud foundry cf deployment, cf nfs volume release, cloudfoundry cf-deployment +1 more +3 more Volume Services is vulnerable to an LDAP injection attack CVE-2019-11277 8.4 HighSeptember 23, 2019
• cloud foundry cf-deployment, credhub, uaa release (oss) +2 more +4 more Java Projects using HTTP to fetch dependencies CVE-2019-3801 8.7 HighApril 25, 2019
• cloud foundry diego, pivotal software cloud foundry diego, cloudfoundry cf-deployment +2 more Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in... CVE-2018-1265 7.2 HighJune 6, 2018
• cloudfoundry routing-release, cloud foundry router, cloudfoundry cf-deployment +2 more Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially… CVE-2018-1193 5.3 MediumMay 23, 2018
• cloud foundry cloudfoundry uaa, cloudfoundry cf-deployment, pivotal software cloud foundry uaa +1 more +3 more UAA privilege escalation across identity zones CVE-2018-1262 Fix available 7.2 HighMay 15, 2018
• cloud foundry garden-runc, cloudfoundry cf-deployment +1 more Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for... CVE-2018-1277 6.5 MediumApril 30, 2018
• cloud foundry garden-runc, cloudfoundry cf-deployment, garden-runc-release +2 more Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure... CVE-2018-1191 8.8 HighMarch 29, 2018
• cloudfoundry cf-deployment, routing-release, dell emc the cloud foundry gorouter +2 more In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Bal… CVE-2018-1221 8.1 HighMarch 19, 2018
• cloudfoundry cf-deployment, cf-release, dell emc cloud controller +1 more +3 more In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf... CVE-2018-1195 8.8 HighMarch 19, 2018
• cloudfoundry capi-release, cf-deployment, cf-release +2 more An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0),... CVE-2017-14389 6.5 MediumNovember 28, 2017