GitHub Advisoryadvisory · Maven
GHSA-x4h3-g2x4-8gqv Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry
MEDIUM
Official page ↗
- Aliases
- CVE-2026-40990
- Ecosystem
- Maven
- Packages
- org.springframework.cloud:spring-cloud-function-context
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H
- Weaknesses
- CWE-770
- Reviewed
- 2026-07-09
Affected packages
• Maven org.springframework.cloud:spring-cloud-function-context: >= 4.3.0, < 4.3.3 → fixed in 4.3.3
• Maven org.springframework.cloud:spring-cloud-function-context: >= 5.0.0, < 5.0.2 → fixed in 5.0.2
• Maven org.springframework.cloud:spring-cloud-function-context: >= 3.2.10, <= 3.2.15 (no fix yet)
• Maven org.springframework.cloud:spring-cloud-function-context: >= 4.1.0, <= 4.1.9 (no fix yet)
• Maven org.springframework.cloud:spring-cloud-function-context: >= 4.2.0, <= 4.2.5 (no fix yet)
Description
OOM error is possible while attempting to add infinite amount of functions to Function Registry.
Affected Spring Products and Versions:
Spring Cloud Function 3.2.x: versions prior to 3.2.16
Spring Cloud Function 4.1.x: versions prior to 4.1.10
Spring Cloud Function 4.2.x: versions prior to 4.2.6
Spring Cloud Function 4.3.x: versions prior to 4.3.3
Spring Cloud Function 5.0.x: versions prior to 5.0.2
Older, unsupported versions are also affected.
Related
Alias · CVE (1)
- CVE-2026-40990 OOM error is possible while attempting to add infinite amount of functions to Function Registry. vulnerability
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness