How many CVEs does vmware spring cloud config have?

vmware spring cloud config has 8 published CVE records since 2019.

How many vmware spring cloud config CVEs are in CISA KEV?

Yes — 1 of vmware spring cloud config's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for vmware spring cloud config vulnerabilities?

Yes — 2 of vmware spring cloud config's CVEs have a known public exploit.

Which versions of vmware spring cloud config are affected?

26 distinct vmware spring cloud config versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in vmware spring cloud config CVEs?

vmware spring cloud config's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-23 (Relative Path Traversal), CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition), CWE-532 (Insertion of Sensitive Information into Log File).

How many critical vmware spring cloud config vulnerabilities are there?

vmware spring cloud config has 1 critical and 3 high-severity CVEs.

What is the average severity of vmware spring cloud config CVEs?

The average CVSS base score across vmware spring cloud config's scored CVEs is 7.0.

vmware spring cloud config Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every vmware spring cloud config version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

3.1.0 <= v < 3.1.144 CVEs
4.1.0 <= v < 4.1.104 CVEs
4.2.0 <= v < 4.2.74 CVEs
4.3.0 <= v < 4.3.34 CVEs
5.0.0 <= v < 5.0.34 CVEs
1.4.0 <= v < 1.4.61 CVE
2.0.0 <= v < 2.0.41 CVE
2.1.0 <= v < 2.1.21 CVE
2.1.0 <= v < 2.1.71 CVE
2.1.0 <= v < 2.1.91 CVE
2.2.0 <= v < 2.2.21 CVE
2.2.0 <= v < 2.2.31 CVE
3.1.0 <= v <= 3.1.61 CVE
4.0.0 <= v <= 4.0.11 CVE

Fixed in

3.1.144 CVEs
4.1.104 CVEs
4.2.74 CVEs
4.3.34 CVEs
5.0.34 CVEs
1.4.61 CVE
2.0.41 CVE
2.1.21 CVE
2.1.71 CVE
2.1.91 CVE
2.2.21 CVE
2.2.31 CVE

Find a version

8 CVEs

Sort

High vulnerability · 2026-05-07
CVE-2026-40981
Patch
CWE-639
High · CVSS 7.5
EPSS 0.4% (36th pct)2026-05-07
High vulnerability · 2026-05-07
CVE-2026-41002
Patch
CWE-367
High · CVSS 8.1
EPSS 0.2% (13th pct)2026-05-07
Medium vulnerability · 2026-05-07
CVE-2026-41004
Patch
CWE-532
Medium · CVSS 4.4
EPSS 0.2% (6th pct)2026-05-07
Critical vulnerability · 2026-05-07
CVE-2026-40982
Patch
CWE-22
Critical · CVSS 9.1
EPSS 0.7% (50th pct)2026-05-07
Medium vulnerability · 2023-03-23
CVE-2023-20859
Patch
Medium · CVSS 5.5
EPSS 0.2% (13th pct)2023-03-23
Directory Traversal with spring-cloud-config-server
CVE-2020-5410
CISA KEV
Public exploit
Patch
CWE-23
Added to CISA KEV 2022-03-25
High · CVSS 8.7
EPSS 95.6% (100th pct)2020-06-02
Medium vulnerability · 2020-03-05
CVE-2020-5405
Patch
CWE-23
Medium · CVSS 6.5
EPSS 68.8% (99th pct)2020-03-05
Medium vulnerability · 2019-05-06
CVE-2019-3799
Public exploit
Patch
CWE-22
Medium · CVSS 6.5
EPSS 85.3% (100th pct)2019-05-06

vmware spring cloud config Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other vmware products

Frequently asked questions

References

Track vmware spring cloud config vulnerabilities