CVE-2026-59315: Spring Cloud Config Monitor Denial of Service

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-27 · updated 2026-08-31
Weakness: CWE-400

Description

The Spring Cloud Config Monitor is susceptible to Denial of Service attacks via malicious payloads. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier

Affected products

Spring Cloud Config: before 3.1.15; from 4.0.0 before 4.2.9; from 4.3.0 before 4.3.5; from 5.0.0 before 5.0.5 — fixed in 3.1.15, 4.2.9, 4.3.5, 5.0.5
Spring Cloud Config: from 5.0.0 through 5.0.4; from 4.3.0 through 4.3.4; from 4.0.0 through 4.2.8; through 3.1.14

How to fix

Upgrade to a fixed version: Spring Cloud Config 3.1.15, 4.2.9, 4.3.5, 5.0.5. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-59315

Get alerted when CVE-2026-59315 or the next vulnerability affects your stack