Executive brief
Spring Cloud Config is a component used to manage configuration settings across distributed applications. A denial of service vulnerability allows attackers to send specially crafted payloads that crash or disable the Config Monitor, disrupting configuration management and potentially causing application unavailability across dependent services.
Technical details
The Spring Cloud Config Monitor is vulnerable to denial of service attacks when processing malicious payloads. The vulnerability affects multiple version branches: 5.0.0–5.0.4, 4.3.0–4.3.4, 4.0.0–4.2.8, and 3.1.14 and earlier. The attack vector requires network access to the Config Monitor endpoint; no authentication is mentioned as a prerequisite. An attacker can trigger resource exhaustion or uncontrolled processing leading to service unavailability. The specific mechanism causing the DoS is not detailed in available sources, but patches are expected to address input validation in payload processing.
Affected products
- Spring Cloud Config 3.1.14 and earlier, 4.0.0 through 4.2.8, 4.3.0 through 4.3.4, 5.0.0 through 5.0.4
Timeline
- 2026-08-27: disclosed