GitHub Advisoryadvisory · Maven

GHSA-x9c7-5h6g-hq8q Spring Cloud Function Context has Uncontrolled Recursion

MEDIUM Published 2026-06-01 Modified 2026-07-09 Official page ↗
Aliases
CVE-2026-40989
Ecosystem
Maven
Packages
org.springframework.cloud:spring-cloud-function-context
Severity
Moderate
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H
Weaknesses
CWE-674
Reviewed
2026-07-09

Affected packages

• Maven org.springframework.cloud:spring-cloud-function-context: >= 4.3.0, < 4.3.3 → fixed in 4.3.3 • Maven org.springframework.cloud:spring-cloud-function-context: >= 5.0.0, < 5.0.2 → fixed in 5.0.2 • Maven org.springframework.cloud:spring-cloud-function-context: >= 3.2.10, <= 3.2.15 (no fix yet) • Maven org.springframework.cloud:spring-cloud-function-context: >= 4.1.0, <= 4.1.9 (no fix yet) • Maven org.springframework.cloud:spring-cloud-function-context: >= 4.2.0, <= 4.2.5 (no fix yet)

Description

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

Related

Alias · CVE (1)

  • CVE-2026-40989 Under infinite recursion in the routing layer, request-handling can cause OOM error. vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References