cve.bz

CVE-2026-40990

6.5 mediumEPSS 0.2%

Medium (6.5) in vmware spring cloud function. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in org.springframework.cloud:spring-cloud-function-context 4.3.3, 5.0.2.

OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS
0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE
CWE-770
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-x4h3-g2x4-8gqvMavenorg.springframework.cloud:spring-cloud-function-context>=4.3.0 <4.3.34.3.3
GHSA-x4h3-g2x4-8gqvMavenorg.springframework.cloud:spring-cloud-function-context>=5.0.0 <5.0.25.0.2
GHSA-x4h3-g2x4-8gqvMavenorg.springframework.cloud:spring-cloud-function-context>=3.2.10 <=3.2.15no fix published
GHSA-x4h3-g2x4-8gqvMavenorg.springframework.cloud:spring-cloud-function-context>=4.1.0 <=4.1.9no fix published
GHSA-x4h3-g2x4-8gqvMavenorg.springframework.cloud:spring-cloud-function-context>=4.2.0 <=4.2.5no fix published

References

Check your stackJSON