SC
Product
Spring Cloud Config
On CISA KEVExploited in the wild
13
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 6Medium 5Low 0
Watch
Add Spring Cloud Config to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-5405 | 6.5 | Mar 5 | Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through… Affected: 2.1.0 before 2.1.7; 2.2.0 before 2.2.2 |
| CVE-2019-3799 | 6.5 | May 6 | Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve… Affected: 1.4.0 before 1.4.6; 2.0.0 before 2.0.4; 2.1.0 before 2.1.2 |
| CVE-2023-20859 | 5.5 | Mar 23 | In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log… Affected: 3.1.0 through 3.1.6; 4.0.0 through 4.0.1 |
| CVE-2026-59315 | 5.3 | Aug 27 | Spring Cloud Config Monitor Denial of Service Affected: before 3.1.15; 4.0.0 before 4.2.9; 4.3.0 before 4.3.5; 5.0.0 before 5.0.5 |
| CVE-2026-41004 | 4.4 | May 7 | When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs Affected: 3.1.0 before 3.1.14; 4.1.0 before 4.1.10; 4.2.0 before 4.2.7; 4.3.0 before 4.3.3; 5.0.0 before 5.0.3 |
Showing 5