CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCVE-2026-40989
Medium (6.5) in vmware spring cloud function. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in org.springframework.cloud:spring-cloud-function-context 4.3.3, 5.0.2.
Under infinite recursion in the routing layer, request-handling can cause OOM error.
Affected Spring Products and Versions:
Spring Cloud Function 3.2.x: versions prior to 3.2.16
Spring Cloud Function 4.1.x: versions prior to 4.1.10
Spring Cloud Function 4.2.x: versions prior to 4.2.6
Spring Cloud Function 4.3.x: versions prior to 4.3.3
Spring Cloud Function 5.0.x: versions prior to 5.0.2
Older, unsupported versions are also affected.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
- CWE
- CWE-674
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vmware:spring_cloud_function
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x9c7-5h6g-hq8q | Maven | org.springframework.cloud:spring-cloud-function-context | >=4.3.0 <4.3.3 | 4.3.3 |
| GHSA-x9c7-5h6g-hq8q | Maven | org.springframework.cloud:spring-cloud-function-context | >=5.0.0 <5.0.2 | 5.0.2 |
| GHSA-x9c7-5h6g-hq8q | Maven | org.springframework.cloud:spring-cloud-function-context | >=3.2.10 <=3.2.15 | no fix published |
| GHSA-x9c7-5h6g-hq8q | Maven | org.springframework.cloud:spring-cloud-function-context | >=4.1.0 <=4.1.9 | no fix published |
| GHSA-x9c7-5h6g-hq8q | Maven | org.springframework.cloud:spring-cloud-function-context | >=4.2.0 <=4.2.5 | no fix published |