CloudFoundry Foundation

Records118All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical11CVSS 9.0–10.0

CVSS high64CVSS 7.0–8.9

Exploited now

CloudFoundry Foundation records in CISA KEV

No CloudFoundry Foundation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cf-deployment 37 records MEDIUM Cf-release 35 records MEDIUM Capi-release 22 records MEDIUM Cloud Foundry Uaa Bosh 15 records MEDIUM User Account And Authentication 9 records MEDIUM Routing-release 8 records MEDIUM Routing Release 5 records LOW Uaa Release 5 records MEDIUM

Records

5 records in Routing Release · all components

TI-2024-14866 CVE-2024-22279 · GHSA-3cff-hppc-4g4r

GoRouter Denial of Service Attack

LOW 33

Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00402 Published 2024-06-10 No fix listed CWE-444

TI-2019-02803 CVE-2019-3789 · GHSA-r999-j7hp-qmgq

Gorouter allows space developer to hijack route services hosted outside the platform

LOW 30

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0076 Published 2019-04-24 Fixed in 0.188.0 CWE-840

TI-2023-07298 CVE-2023-20882 · GHSA-f2f8-4q6m-2pw8

Uncontrolled resource consumption in Cloud Foundry Routing release

LOW 27

In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00581 Published 2023-05-26 No fix listed CWE-400

TI-2020-04447 CVE-2020-5401 · GHSA-jgr4-5mrv-w8ph

Cloud Foundry GoRouter is vulnerable to cache poisoning

LOW 26

Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to reject subsequent legitimate clients trying to access the app…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01037 Published 2020-02-27 Fixed in 0.197.0 CWE-393

TI-2026-18251 CVE-2026-22726 · GHSA-rmvv-67vj-q642

Route Services Firewall Bypass

LOW 22

Route Services can be leveraged to send app traffic to network destinations outside of an app's configured egress rules.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00199 Published 2026-04-30 Fixed in v0.372.0, v55.0.0 CWE-923

Open these records in search →