EUVD-2026-67197
GHSA-m8cp-w83w-vr3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed /monitor webhook endpoint
-
DeliveryCraft malicious HTTP payload
-
ExploitSubmit unauthenticated POST request
-
ExecutionTrigger resource exhaustion in monitor processing
-
ImpactDeny service to Config Server consumers
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The spring-cloud-config-monitor dependency must be present and active in the deployment - the Monitor endpoint (/monitor) is not included in a base Spring Cloud Config Server unless this optional module is added. The endpoint must be reachable over the network by the attacker. No authentication is required per the CVSS vector (PR:N), and no user interaction is needed (UI:N). Exploitation is strictly limited to availability impact; no data access or modification is possible. Deployments where the Config Server is internal-only or where the /monitor endpoint is protected by network controls face substantially lower risk than those with internet-exposed webhook endpoints. |
| Impact | The vendor-assigned CVSS 5.3 Medium with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L accurately reflects a remotely exploitable, zero-prerequisite DoS with limited (partial) availability impact and no confidentiality or integrity exposure. Attack complexity is low and no privileges are required, making this trivially exploitable by any network-adjacent attacker. However, the Scope:Unchanged and A:L rating cap the blast radius - impact is confined to the Config Server process itself, not the downstream microservices directly (though configuration refresh disruption is a secondary operational consequence). No KEV listing and no identified POC lower operational urgency. EPSS data was not provided, so exploitation probability cannot be quantified. Real-world risk is heavily deployment-dependent: organizations with the /monitor endpoint internet-exposed face meaningfully higher risk than those with Config Server on internal networks only. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP POST request with a malicious payload to the publicly reachable /monitor endpoint of a Spring Cloud Config Server. The malformed payload triggers resource exhaustion or a processing error in the monitor handler, causing the Config Server to become unresponsive or crash. No POC has been identified, but the AC:L/PR:N vector means any attacker with network access can attempt this without special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 27, 2026
Denial of Service in Spring Cloud Config's Monitor component allows unauthenticated remote attackers to crash or degrade the configuration server by submitting malicious payloads to the webhook endpoint. Affected versions span the 3.x, 4.x, and 5.x release lines, covering a broad installed base of Spring Boot microservice environments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated network-accessible attack surface (PR:N, AV:N, AC:L) means exploitation requires minimal capability.
RemediationAI
Consult and apply the patched release identified in the VMware/Spring security advisory at https://spring.io/security/cve-2026-59315 - exact fix versions were not included in the available input data and should be confirmed directly from that source before upgrading. As an immediate compensating control, restrict access to the /monitor endpoint at the network or reverse proxy layer to only trusted IP ranges corresponding to known VCS webhook sources (e.g., GitHub's published IP ranges), eliminating the unauthenticated public attack surface; the trade-off is operational overhead of maintaining the IP allowlist. If webhook-based refresh via the Monitor feature is not actively used, removing or disabling the spring-cloud-config-monitor dependency entirely eliminates the attack surface with no impact to core configuration serving functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Spring Cloud Config provides centralized externalized configuration for distributed Spring Boot applications. The Monitor component (spring-cloud-config-monitor) exposes a /monitor HTTP endpoint designed to receive webhook push notifications from version control systems (GitHub, GitLab, Bitbucket) and trigger downstream property refresh events. The vulnerability lies in how this endpoint processes incoming payloads - maliciously crafted inputs can cause resource exhaustion or processing failure. No CWE was assigned by the reporter, but the DoS-via-payload pattern is consistent with CWE-400 (Uncontrolled Resource Consumption) or CWE-20 (Improper Input Validation). The affected CPE is cpe:2.3:a:spring:spring_cloud_config covering versions from 3.x through 5.0.4, reported by VMware (the Spring project steward under Broadcom).
Know when Spring gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable unauthenticated endpoint; no credentials needed; impact is availability-only and partial, consistent with a DoS-class flaw.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
DescriptionCVE.org
The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. Rated critical severi
Access control bypass in SpringBlade v4.5.0 importUser function allows low-privileged users to import sensitive user dat
Spring Cloud Config Server contains a path traversal vulnerability when using the native file system backend, allowing u
Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant
SpringBlade v4.5.0 has an access control flaw in authRoutes allowing low-privileged users to escalate to admin through t
Remote code execution in Spring for GraphQL versions 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3 allows unauthenticated at
Server-Sent Events (SSE) stream corruption affects Spring MVC applications built on the functional web framework across
Spring AI versions 1.0.0 through 1.0.4 and 1.1.0 through 1.1.3 allow unauthenticated remote code execution through Sprin
Unsafe JSON deserialization in Spring Framework's JMS message converters (MappingJackson2MessageConverter and JacksonJso
Spring Security Aspects may not correctly locate method security annotations on private methods. Rated critical severity
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input esca
Directory traversal in Spring Cloud Config server module allows remote unauthenticated attackers to read arbitrary files
Exploit-DB