GitHub Advisoryadvisory · Maven
GHSA-x9c7-5h6g-hq8q Spring Cloud Function Context has Uncontrolled Recursion
MEDIUM
Official page ↗
- Aliases
- CVE-2026-40989
- Ecosystem
- Maven
- Packages
- org.springframework.cloud:spring-cloud-function-context
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H
- Weaknesses
- CWE-674
- Reviewed
- 2026-07-09
Affected packages
• Maven org.springframework.cloud:spring-cloud-function-context: >= 4.3.0, < 4.3.3 → fixed in 4.3.3
• Maven org.springframework.cloud:spring-cloud-function-context: >= 5.0.0, < 5.0.2 → fixed in 5.0.2
• Maven org.springframework.cloud:spring-cloud-function-context: >= 3.2.10, <= 3.2.15 (no fix yet)
• Maven org.springframework.cloud:spring-cloud-function-context: >= 4.1.0, <= 4.1.9 (no fix yet)
• Maven org.springframework.cloud:spring-cloud-function-context: >= 4.2.0, <= 4.2.5 (no fix yet)
Description
Under infinite recursion in the routing layer, request-handling can cause OOM error.
Affected Spring Products and Versions:
Spring Cloud Function 3.2.x: versions prior to 3.2.16
Spring Cloud Function 4.1.x: versions prior to 4.1.10
Spring Cloud Function 4.2.x: versions prior to 4.2.6
Spring Cloud Function 4.3.x: versions prior to 4.3.3
Spring Cloud Function 5.0.x: versions prior to 5.0.2
Older, unsupported versions are also affected.
Related
Alias · CVE (1)
- CVE-2026-40989 Under infinite recursion in the routing layer, request-handling can cause OOM error. vulnerability
Weakness · CWE (1)
- CWE-674 Uncontrolled Recursion weakness