# Confluence in June 2026: incidents, uptime and changes

> Confluence in June 2026: 3 incidents on its status page (0 major or critical), 100% free of major or critical incidents (vendor-reported), 28 CVEs. From Rewindex’s archive of Confluence’s status, pricing and policy pages.

Canonical: https://rewindex.com/company/confluence/2026/06
Last updated: 2026-10-26T12:10:00Z

- Incidents posted: 3 (major/critical: 0) · Maintenance: 0
- By vendor impact label: minor 3
- Uptime (vendor-reported): 100% free of major/critical incidents, 99.31% free of any incident; outage time 0 min, incident time 4 h 57 min
- Price changes: 0 · Pricing/legal/trust page changes: 0 · Deprecations: 0 · CVEs: 28
- Previous month: [May 2026](https://rewindex.com/company/confluence/2026/05.md) · Next: [July 2026](https://rewindex.com/company/confluence/2026/07.md) · [All months](https://rewindex.com/company/confluence/reports.md) · [Confluence](https://rewindex.com/company/confluence.md)

_Uptime: Derived from the incidents the vendor posted on its own status page, not measured by us. A minute counts as an outage minute when a major or critical incident (as the vendor labelled it) was open; incident minutes include minor ones too. Maintenance and incidents marked "no impact" are left out, overlapping incidents are merged, a resolved incident counts for at most 7 days, and one still open with no resolution counts for at most 24 hours._

## All incidents

| Incident | Impact (vendor label) | Started (UTC) | Resolved (UTC) | Duration | Status |
| --- | --- | --- | --- | --- | --- |
| [Delays in processing incoming Emails, Work Item notifications, and Scheduled Triggers in Marketplace Apps](https://rewindex.com/company/confluence/incidents/7lx9dwy4g7gf.md) | minor | 2026-06-10 06:14 UTC | 2026-06-10 06:31 UTC | 17 min | resolved |
| [Degraded performance with Confluence Cloud](https://rewindex.com/company/confluence/incidents/6v0066q7rdjx.md) | minor | 2026-06-12 08:45 UTC | 2026-06-12 11:15 UTC | 2.5 h | postmortem |
| [Confluence Cloud experiencing degraded viewing experience](https://rewindex.com/company/confluence/incidents/vcf8hmz1l4w2.md) | minor | 2026-06-16 13:46 UTC | 2026-06-16 15:56 UTC | 2.2 h | postmortem |

## CVEs published

- [CVE-2026-40983](https://rewindex.com/cve/CVE-2026-40983.md) Micrometer gRPC server instrumentation DoS vulnerability (CVSS 7.5), published 2026-06-09
- [CVE-2026-41842](https://rewindex.com/cve/CVE-2026-41842.md) Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux (CVSS 7.5), published 2026-06-09
- [CVE-2026-41845](https://rewindex.com/cve/CVE-2026-41845.md) Spring Framework Cross-site Scripting via JavaScriptUtils (CVSS 7.1), published 2026-06-09
- [CVE-2026-41850](https://rewindex.com/cve/CVE-2026-41850.md) Spring Framework Algorithmic Denial of Service via SpEL Expressions (CVSS 7.5), published 2026-06-09
- [CVE-2026-46625](https://rewindex.com/cve/CVE-2026-46625.md) JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection (CVSS 7.5), published 2026-06-10
- [CVE-2026-44492](https://rewindex.com/cve/CVE-2026-44492.md) Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO\_PROXY bypass (incomplete fix for CVE-2025-62718) (CVSS 8.6), published 2026-06-11
- [CVE-2026-44494](https://rewindex.com/cve/CVE-2026-44494.md) Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in \`config.proxy\` (CVSS 8.7), published 2026-06-11
- [CVE-2026-44495](https://rewindex.com/cve/CVE-2026-44495.md) Axios: Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge (CVSS 7.0), published 2026-06-11
- [CVE-2026-44496](https://rewindex.com/cve/CVE-2026-44496.md) Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection (CVSS 7.5), published 2026-06-11
- [CVE-2026-44490](https://rewindex.com/cve/CVE-2026-44490.md) Axios: DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions (CVSS 4.8), published 2026-06-11
- [CVE-2026-44488](https://rewindex.com/cve/CVE-2026-44488.md) Axios: Allocation of Resources Without Limits or Throttling in axios (CVSS 7.5), published 2026-06-11
- [CVE-2026-44487](https://rewindex.com/cve/CVE-2026-44487.md) Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter (CVSS 7.5), published 2026-06-11
- [CVE-2026-44486](https://rewindex.com/cve/CVE-2026-44486.md) Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection (CVSS 7.5), published 2026-06-11
- [CVE-2026-44249](https://rewindex.com/cve/CVE-2026-44249.md) Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (CVSS 8.1), published 2026-06-11
- [CVE-2026-45416](https://rewindex.com/cve/CVE-2026-45416.md) Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (CVSS 7.5), published 2026-06-12
- [CVE-2026-45674](https://rewindex.com/cve/CVE-2026-45674.md) Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (CVSS 8.7), published 2026-06-12
- [CVE-2026-47691](https://rewindex.com/cve/CVE-2026-47691.md) Netty has Insufficient Bailiwick Validation for NS Records (CVSS 8.7), published 2026-06-12
- [CVE-2026-48043](https://rewindex.com/cve/CVE-2026-48043.md) netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion (CVSS 5.3), published 2026-06-12
- [CVE-2026-50010](https://rewindex.com/cve/CVE-2026-50010.md) Netty's wrapping plain trust manager silently disables hostname verification (CVSS 7.5), published 2026-06-12
- [CVE-2026-12143](https://rewindex.com/cve/CVE-2026-12143.md) form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) (CVSS 7.5), published 2026-06-12
- [CVE-2026-48779](https://rewindex.com/cve/CVE-2026-48779.md) ws: Memory exhaustion DoS from tiny fragments and data chunks (CVSS 7.5), published 2026-06-16
- [CVE-2026-54513](https://rewindex.com/cve/CVE-2026-54513.md) jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) (CVSS 8.1), published 2026-06-23
- [CVE-2026-54512](https://rewindex.com/cve/CVE-2026-54512.md) jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation (CVSS 8.1), published 2026-06-23
- [CVE-2026-13006](https://rewindex.com/cve/CVE-2026-13006.md) Incomplete protection against CVE-2025-11226 (CVSS 7.0), published 2026-06-24
- [CVE-2026-13676](https://rewindex.com/cve/CVE-2026-13676.md) fast-uri vulnerable to host confusion via failed IDN canonicalization (CVSS 7.5), published 2026-06-29
- [CVE-2026-53404](https://rewindex.com/cve/CVE-2026-53404.md) Apache Tomcat: Bad ornext processing in RewriteValve (CVSS 7.3), published 2026-06-29
- [CVE-2026-53434](https://rewindex.com/cve/CVE-2026-53434.md) Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector (CVSS 9.1), published 2026-06-29
- [CVE-2026-55276](https://rewindex.com/cve/CVE-2026-55276.md) Apache Tomcat: Logged effective web.xml is incomplete (CVSS 9.1), published 2026-06-29

## Cite this

Confluence posted 3 status incidents in June 2026 (0 major or critical); 0 price changes and 0 notable page changes observed.

- Canonical URL: https://rewindex.com/company/confluence/2026/06
- Citation: Confluence, “Confluence in June 2026” (2026-06-01 00:00 UTC). Archived by Rewindex: https://rewindex.com/company/confluence/2026/06 (CC BY 4.0).
- Markdown link: `[Confluence: Confluence in June 2026 (2026-06-01)](https://rewindex.com/company/confluence/2026/06)`


---
Canonical: https://rewindex.com/company/confluence/2026/06 · Markdown: https://rewindex.com/company/confluence/2026/06.md · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T15:01:58.860Z