[FP]: spring_cloud_config CVEs reported for spring-cloud-kubernetes-client-autoconfig

[xcq1]

Package URl

pkg:maven/org.springframework.cloud/spring-cloud-kubernetes-client-autoconfig@5.0.2

CPE

cpe:2.3:a:vmware:spring_cloud_config:5.0.2:*:*:*:*:*:*:*

CVE

No response

ODC Integration

{"label" => "Gradle Plugin"}

ODC Version

12.2.2

Description

This reports:

• CVE-2026-40982
• CVE-2026-41002
• CVE-2026-40981
• CVE-2026-41004

All of these recommend to upgrade Spring Cloud Config to 5.0.3. However the report is actually for a config package from Spring Cloud Kubernetes whose latest version is 5.0.2 and cloud-config does not appear in my dependency graph.

[github-actions]

Maven Coordinates

<dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-kubernetes-client-autoconfig</artifactId>
  <version>5.0.2</version>
</dependency>

Suppression rule:

<suppress base="true">
    <notes><![CDATA[
    FP per issue #8666
    ]]></notes>
    <packageUrl regex="true">^pkg:maven/org\.springframework\.cloud/spring-cloud-kubernetes-client-autoconfig@.*$</packageUrl>
    <cpe regex="true">cpe:/a:vmware:spring_cloud_config(:.*)?$</cpe>
</suppress>

Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/29318361867

[chadlwilson]

Approved

Probably needs a custom suppression or there’ll be dozens of these, most likely.

[github-actions]

Suppress rule has been added to the generatedSuppressions branch.