VMware Tanzu Spring Cloud Function: Mehrere Schwachstellen ermöglichen Denial of Service

Summary

Product

Vulnerabilities 2

• Medium 5.7
  CVE-2026-40989

  Self Routing guard bypassed via function composition

  Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x…

  Spring Spring Cloud Function org.springframework.cloud:spring-cloud-function-context Maven
  Jun 1, 2026
• Medium 5.7
  CVE-2026-40990

  Unbounded cache for function definitions

  OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Fu…

  Spring Spring Cloud Function org.springframework.cloud:spring-cloud-function-context Maven
  Jun 1, 2026

Revision history

1. 2026-06-01 #2

   Referenz(en) aufgenommen: EUVD-2026-33734, EUVD-2026-33733

2. 2026-05-07 #1

   Initiale Fassung

References

• Spring Security Advisories vom 2026-05-07
  https://spring.io/security/cve-2026-40989
• Spring Security Advisories vom 2026-05-07
  https://spring.io/security/cve-2026-40990