Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework.cloud:spring-cloud-config-server

8 known vulnerabilities (1 critical, 4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
5.0.6 (Oct 22, 2026): no advisory affects it
Newest unaffected release
5.0.6 (Oct 22, 2026), the latest release
Advisories
8 · 1 critical, 4 high, 1 medium
Dependents
5
Releases
110 since 1.0.0.RELEASE (Mar 3, 2015)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-40981
    Affects 3.1.0 to 3.1.10 (4.0.0 is outside it); 4.1.0 to 4.3.2 (4.3.3 is outside it); 5.0.0 to 5.0.2 (5.0.3 is outside it)
  • CVE-2026-41002
    Affects 3.0.0 to 3.1.10 (4.0.0 is outside it); 4.1.0 to 4.3.2 (4.3.3 is outside it); 5.0.0 to 5.0.2 (5.0.3 is outside it)
  • CVE-2026-41004
    Affects 3.0.0 to 3.1.10 (4.0.0 is outside it); 4.1.0 to 4.3.2 (4.3.3 is outside it); 5.0.0 to 5.0.2 (5.0.3 is outside it)
  • CVE-2026-40982
    Affects 1.0.0.RELEASE to 3.1.10 (4.0.0 is outside it); 4.1.0 to 4.3.2 (4.3.3 is outside it); 5.0.0 to 5.0.2 (5.0.3 is outside it)
  • CVE-2026-22739
    Affects 1.0.0.RELEASE to 4.3.1 (4.3.2 is outside it); 5.0.0-M1 to 5.0.1 (5.0.2 is outside it)
  • CVE-2020-5410
    Affects 2.1.0.RELEASE to 2.1.8.RELEASE (2.1.9.RELEASE is outside it); 2.2.0.RELEASE to 2.2.2.RELEASE (2.2.3.RELEASE is outside it)
  • CVE-2020-5405
    Affects 2.1.0.RELEASE to 2.1.6.RELEASE (2.1.7.RELEASE is outside it); 2.2.0.RELEASE to 2.2.1.RELEASE (2.2.2.RELEASE is outside it)
  • CVE-2019-3799
    Affects 1.0.0.RELEASE to 1.4.5.RELEASE (1.4.6.RELEASE is outside it); 2.0.0.RELEASE to 2.0.3.RELEASE (2.0.4.RELEASE is outside it); 2.1.0.RELEASE to 2.1.1.RELEASE (2.1.2.RELEASE is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 8

  • When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server…

    Affected: from 3.1.0, through 3.1.13; from 4.1.0, through 4.1.9; from 4.2.0, through 4.2.6; from 4.3.0, fixed in 4.3.3; from 5.0.0, fixed in 5.0.3.

    Fixed in 4.3.3 (released May 6, 2026, 1 day before disclosure) and 5.0.3 (released May 6, 2026, 1 day before disclosure).

    The latest release, 5.0.6, is not affected.

  • The base directory (`spring.cloud.config.server.git.basedir`) used by the Spring Cloud Config Server to clone Git repositories to is…

    Affected: from 3.1.0, through 3.1.13; from 4.1.0, through 4.1.9; from 4.2.0, through 4.2.6; from 4.3.0, fixed in 4.3.3; from 5.0.0, fixed in 5.0.3; from 3.0.0, through 3.0.7.

    Fixed in 4.3.3 (released May 6, 2026, 1 day before disclosure) and 5.0.3 (released May 6, 2026, 1 day before disclosure).

    The latest release, 5.0.6, is not affected.

  • CVE-2026-41004Medium 4.4

    When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.

    Affected: from 3.1.0, through 3.1.13; from 4.1.0, through 4.1.9; from 4.2.0, through 4.2.6; from 4.3.0, fixed in 4.3.3; from 5.0.0, fixed in 5.0.3; from 3.0.0, through 3.0.7.

    Fixed in 4.3.3 (released May 6, 2026, 1 day before disclosure) and 5.0.3 (released May 6, 2026, 1 day before disclosure).

    The latest release, 5.0.6, is not affected.

  • CVE-2026-40982Critical 9.1

    Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module.

    Affected: through 3.1.13; from 4.1.0, through 4.1.9; from 4.2.0, through 4.2.6; from 4.3.0, fixed in 4.3.3; from 5.0.0, fixed in 5.0.3.

    Fixed in 4.3.3 (released May 6, 2026, 1 day before disclosure) and 5.0.3 (released May 6, 2026, 1 day before disclosure).

    The latest release, 5.0.6, is not affected.

  • Spring Cloud Config Profile Substitution Can Allow Unintended Access To Files And Enable SSRF Attacks

    Affected: from 4.3.0, fixed in 4.3.2; from 5.0.0-M1, fixed in 5.0.2; from 4.2.0, through 4.2.4; from 4.0.0, through 4.1.7; through 3.1.10.

    Fixed in 4.3.2 (released Mar 23, 2026, 1 day before disclosure) and 5.0.2 (released Mar 23, 2026, 1 day before disclosure).

    The latest release, 5.0.6, is not affected.

  • CVE-2020-5410High 7.5 · KEV

    Directory Traversal with spring-cloud-config-server

    Affected: from 2.1.0, fixed in 2.1.9; from 2.2.0, fixed in 2.2.3.

    Fixed in 2.1.9.RELEASE (released May 28, 2020, 5 days before disclosure) and 2.2.3.RELEASE (released May 28, 2020, 5 days before disclosure).

    The latest release, 5.0.6, is not affected.

  • Directory Traversal with spring-cloud-config-server

    Affected: from 2.1.0, fixed in 2.1.7; from 2.2.0, fixed in 2.2.2.

    Fixed in 2.1.7.RELEASE (released Mar 2, 2020, 3 days before disclosure) and 2.2.2.RELEASE (released Mar 4, 2020, 1 day before disclosure).

    The latest release, 5.0.6, is not affected.

  • Directory Traversal with spring-cloud-config-server

    Affected: fixed in 1.4.6; from 2.0.0, fixed in 2.0.4; from 2.1.0, fixed in 2.1.2.

    Fixed in 1.4.6.RELEASE (released Apr 16, 2019, 20 days before disclosure), 2.0.4.RELEASE (released Apr 16, 2019, 20 days before disclosure) and 2.1.2.RELEASE (released Apr 16, 2019, 20 days before disclosure).

    The latest release, 5.0.6, is not affected.