GitHub Advisoryadvisory · Maven

GHSA-x4h3-g2x4-8gqv Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

MEDIUM Published 2026-06-01 Modified 2026-07-09 Official page ↗
Aliases
CVE-2026-40990
Ecosystem
Maven
Packages
org.springframework.cloud:spring-cloud-function-context
Severity
Moderate
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H
Weaknesses
CWE-770
Reviewed
2026-07-09

Affected packages

• Maven org.springframework.cloud:spring-cloud-function-context: >= 4.3.0, < 4.3.3 → fixed in 4.3.3 • Maven org.springframework.cloud:spring-cloud-function-context: >= 5.0.0, < 5.0.2 → fixed in 5.0.2 • Maven org.springframework.cloud:spring-cloud-function-context: >= 3.2.10, <= 3.2.15 (no fix yet) • Maven org.springframework.cloud:spring-cloud-function-context: >= 4.1.0, <= 4.1.9 (no fix yet) • Maven org.springframework.cloud:spring-cloud-function-context: >= 4.2.0, <= 4.2.5 (no fix yet)

Description

OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

Related

Alias · CVE (1)

  • CVE-2026-40990 OOM error is possible while attempting to add infinite amount of functions to Function Registry. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References