Skip to content

Cloud Foundry · weakness class

Denial of Service

9 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

  1. CF clusters with NGINX in front of them may be vulnerable to DoSCVE-2020-5416Cloud Foundry · CVSS 7.7 · 1.2% likely

    CWE-404

  2. Cloud Controller is vulnerable to denial of service via YAML parsingCVE-2020-5423Cloud Foundry · CVSS 7.5 · 1.1% likely

    CWE-400

  3. Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. A remote authenticated user may push an app with a malicious D…CVE-2018-1277Cloud Foundry · 1.1% likely

    CWE-400

  4. Cloud Controller versions prior to 1.118.0 are vulnerable to unauthenticated denial of Service(DoS) vulnerability allowing unauthenticated attackers to cause denial of service by…CVE-2021-22101Cloudfoundry · 1.0% likely

    CWE-400

  5. In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) causes CC instances to…CVE-2021-22100Cloudfoundry · 0.9% likely

    CWE-400

  6. In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry.…CVE-2023-20882Cloudfoundry · CVSS 5.9 · 0.6% likely

    CWE-400

  7. CVE-2023-34061 – Gorouter route pruningCVE-2023-34061Cloud Foundry · CVSS 7.5 · 0.5% likely

    CWE-400

  8. CVE-2024-38826 Cloud Controller Denial of Service AttackCVE-2024-38826Cloud Foundry · CVSS 5.3 · 0.4% likely

    CWE-400

  9. DoS Vulnerability in UAA Related to JWKS URI HandlingCVE-2026-59396Cloud Foundry · CVSS 4.9 · 0.3% likely

    CWE-400

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP

Updated AboutDevelopersSign in