Spring Cloud vulnerabilities

• spring cloud config, vmware spring cloud config +1 more Spring Cloud Config Monitor Denial of Service CVE-2026-59315 5.3 MediumAugust 27, 2026
• spring cloud stream, vmware spring cloud stream +1 more Potential for deserialization of untrusted types in Spring Cloud Stream CVE-2026-59306 3.1 LowAugust 27, 2026
• spring cloud stream, vmware spring cloud stream +1 more Partition interceptor may be improperly added while sending message CVE-2026-59305 3.1 LowAugust 27, 2026
• spring cloud stream, vmware spring cloud stream +1 more Improper caching of the original content type in Spring Cloud Stream Avro CVE-2026-59304 3.1 LowAugust 27, 2026
• spring cloud stream, vmware spring cloud stream +1 more Dynamic destination cache size is not properly bound in Spring Cloud Stream CVE-2026-59303 3.1 LowAugust 27, 2026
• spring cloud stream, vmware spring cloud function +1 more Potential for logging sensitive data in Spring Cloud Stream CVE-2026-59302 3.1 LowAugust 27, 2026
• spring cloud function, vmware spring cloud function +1 more Potential for logging sensitive data in Spring Cloud Function Azure CVE-2026-59301 3.1 LowAugust 27, 2026
• spring cloud function, vmware spring cloud function +1 more Potential for logging sensitive data in Spring Cloud Function AWS CVE-2026-59300 3.1 LowAugust 27, 2026
• spring cloud function, vmware spring cloud function +1 more Composition lookup can potentially poison base function in Spring Cloud Function CVE-2026-59299 3.1 LowAugust 27, 2026
• spring cloud function, vmware spring cloud function +1 more Potential for improper filtering of HTTP headers in Spring Cloud Function CVE-2026-59298 3.1 LowAugust 27, 2026
• spring cloud function, vmware spring cloud function +1 more Spring Cloud Function can incorrectly determine if URI is secure CVE-2026-59297 3.1 LowAugust 27, 2026
• spring cloud function, vmware spring cloud function +1 more Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function CVE-2026-59291 2.0 LowAugust 27, 2026
• broadcom spring cloud commons, spring cloud commons +1 more Spring Cloud Commons no allow list for writable env actuator endpoint CVE-2026-59284 Fix available 6.6 MediumAugust 27, 2026
• spring cloud config, vmware spring cloud config +1 more Spring Cloud Config Server Native Environment Repository Exposure CVE-2026-47894 4.9 MediumAugust 27, 2026
• spring cloud gateway, vmware spring cloud gateway +1 more Spring Cloud Gateway SSRF and native file access with gRPC CVE-2026-47879 7.7 HighAugust 27, 2026
• spring cloud config, vmware spring cloud config +1 more Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests CVE-2026-47837 6.8 MediumAugust 26, 2026
• spring cloud config, vmware spring cloud config +1 more Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN CVE-2026-47836 7.2 HighAugust 26, 2026
• spring cloud gateway, vmware spring cloud gateway +1 more Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations CVE-2026-47825 8.6 HighJune 15, 2026
• broadcom spring cloud sleuth, spring cloud sleuth +1 more Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability CVE-2026-41708 7.5 HighJune 15, 2026
• spring cloud function, vmware spring cloud function +1 more Unbounded cache for function definitions CVE-2026-40990 Fix available 5.7 MediumJune 1, 2026
• spring cloud function, vmware spring cloud function +1 more Self Routing guard bypassed via function composition CVE-2026-40989 Fix available 5.7 MediumJune 1, 2026
• spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 more Spring Cloud Config has an Authorization Bypass Through User-Controlled Key CVE-2026-40981 Fix available 7.5 HighMay 7, 2026
• spring cloud config, vmware spring cloud config +1 more Spring Cloud Config Server Susceptible To TOCTOU Attack CVE-2026-41002 Fix available 7.4 HighMay 7, 2026
• spring cloud config, vmware spring cloud config +1 more Spring Cloud Config Server Logged Sensitive Information CVE-2026-41004 Fix available 4.4 MediumMay 7, 2026
• spring cloud config, vmware spring cloud config, red hat enterprise linux 8 +1 more +3 more Spring Cloud Config vulnerable to Path Traversal CVE-2026-40982 Public exploitFix available 9.1 CriticalMay 7, 2026
• spring cloud, vmware spring cloud config +1 more Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks CVE-2026-22739 Fix available 8.6 HighMarch 24, 2026
• spring cloud config Spring Cloud Config Server May Not Use Vault Token Sent By Clients CVE-2025-22232 5.3 MediumApril 10, 2025
• spring cloud data flow, vmware spring cloud data flow +1 more CVE-2024-37084: Remote code execution in Spring Cloud Data Flow CVE-2024-37084 Public exploitFix available EPSS 35.2% 9.8 CriticalJuly 25, 2024
• spring cloud contract, vmware spring cloud contract +1 more Spring Cloud Contract vulnerable to local information disclosure CVE-2024-22236 Fix available 3.3 LowJanuary 31, 2024
• spring cloud data flow, vmware spring cloud data flow +1 more Possibility of SQL Injection in Spring Cloud Data Flow Task Execution Sorting Query CVE-2020-5427 Fix available 5.7 MediumJanuary 27, 2021
• spring cloud config, vmware spring cloud config, vmware tanzu spring cloud configuration (config) server +2 more Directory Traversal with spring-cloud-config-server CVE-2020-5410 In KEVPublic exploitFix available EPSS 95.6% 7.5 HighJune 2, 2020
• spring cloud config, vmware spring cloud config +1 more Directory Traversal with spring-cloud-config-server CVE-2020-5405 Public exploitFix available EPSS 68.5% 6.5 MediumMarch 5, 2020
• spring cloud config, vmware spring cloud config, oracle communications cloud native core policy +2 more Directory Traversal with spring-cloud-config-server CVE-2019-3799 Public exploitFix available EPSS 85.3% 6.5 MediumMay 6, 2019