GHSA-x9c7-5h6g-hq8qMediumCVSS 5.7

Spring Cloud Function Context has Uncontrolled Recursion

Published
June 1, 2026
Last Modified
July 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-40989 →

📋 Description

Under infinite recursion in the routing layer, request-handling can cause OOM error.

Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

🎯 Affected products5

  • maven/org.springframework.cloud:spring-cloud-function-context:>= 4.3.0, < 4.3.3
  • maven/org.springframework.cloud:spring-cloud-function-context:>= 5.0.0, < 5.0.2
  • maven/org.springframework.cloud:spring-cloud-function-context:>= 3.2.10, <= 3.2.15
  • maven/org.springframework.cloud:spring-cloud-function-context:>= 4.1.0, <= 4.1.9
  • maven/org.springframework.cloud:spring-cloud-function-context:>= 4.2.0, <= 4.2.5

🔗 References (4)