CVE-2026-59315

Analyzed Analyzed - Analysis Complete

Denial of Service in Spring Cloud Config

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: VMware

Description

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59315

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_cloud_config	From 5.0.0 (inc) to 5.0.5 (exc)
vmware	spring_cloud_config	to 3.1.15 (exc)
vmware	spring_cloud_config	From 4.0.0 (inc) to 4.2.9 (exc)
vmware	spring_cloud_config	From 4.3.0 (inc) to 4.3.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

The Spring Cloud Config Monitor is vulnerable to Denial of Service (DoS) attacks through malicious payloads. This allows attackers to disrupt service availability by sending specially crafted inputs that consume excessive resources.

Detection Guidance

Detecting this vulnerability requires checking the installed version of Spring Cloud Config. Use commands like 'curl -s http://<config-server>/actuator/info' or 'curl -s http://<config-server>/env' to inspect the server. If the version falls within the affected ranges (3.1.14 and earlier, 4.0.0-4.2.8, 4.3.0-4.3.4, or 5.0.0-5.0.4), the system is vulnerable.

Impact Analysis

This vulnerability can cause service outages by overwhelming the Spring Cloud Config Monitor with malicious requests, leading to degraded or unavailable services for users relying on the system.

Compliance Impact

This vulnerability primarily enables Denial of Service attacks, which could disrupt service availability. While not directly violating GDPR or HIPAA, such disruptions may impact compliance by failing to maintain access to personal data or critical systems as required by these regulations.

Mitigation Strategies

Upgrade to fixed versions: 5.0.5 (OSS), 4.3.5 (Enterprise Support Only), 4.2.9 (Enterprise Support Only), or 3.1.15 (Enterprise Support Only). No additional mitigation steps are required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-59315. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70