On behalf of the team and everyone who has contributed, I am pleased to announce that the Spring Cloud Config 3.1.10, 4.0.10, 4.1.6, 4.2.1, 4.3.0-M3 are available now which fix CVE-2025-22232.

Spring Cloud Config 4.0.10 is a commercial only release and is not available in Maven Central.

Please refer to the releases page for more detail on what is included in each release.