Quick answers
- Is CVE-2026-59315 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59315 being exploited in the wild.
- How severe is CVE-2026-59315?
- Medium severity, with a CVSS score of 5.3, published 27 August 2026.
- Which products and versions are affected?
- Spring Cloud Config 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, 5.0.0 through 5.0.4.
- Is there a fix for CVE-2026-59315?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-59315 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-59315?
- Check whether you run Spring Cloud Config at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Spring Cloud Config Monitor is vulnerable to denial of service attacks when processing malicious payloads. The vulnerability affects multiple version branches: 5.0.0–5.0.4, 4.3.0–4.3.4, 4.0.0–4.2.8, and 3.1.14 and earlier. The attack vector requires network access to the Config Monitor endpoint; no authentication is mentioned as a prerequisite. An attacker can trigger resource exhaustion or uncontrolled processing leading to service unavailability. The specific mechanism causing the DoS is not detailed in available sources, but patches are expected to address input validation in payload processing.
Affected products
- Spring Cloud Config 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, 5.0.0 through 5.0.4
Timeline
- 2026-08-27: disclosed