Description
Under infinite recursion in the routing layer, request-handling can cause OOM error.
Affected Spring Products and Versions:
Spring Cloud Function 3.2.x: versions prior to 3.2.16
Spring Cloud Function 4.1.x: versions prior to 4.1.10
Spring Cloud Function 4.2.x: versions prior to 4.2.6
Spring Cloud Function 4.3.x: versions prior to 4.3.3
Spring Cloud Function 5.0.x: versions prior to 5.0.2
Older, unsupported versions are also affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Spring Cloud Function | 3.2.0 – < 3.2.16, 4.1.0 – < 4.1.10, 4.2.0 – < 4.2.6, 4.3.0 – < 4.3.3, 5.0.0 – < 5.0.2 | 3.2.16 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-function-context | >= 4.3.0, < 4.3.3 | 4.3.3 | GHSA-x9c7-5h6g-hq8q |
| Maven | org.springframework.cloud:spring-cloud-function-context | >= 5.0.0, < 5.0.2 | 5.0.2 | GHSA-x9c7-5h6g-hq8q |
| Maven | org.springframework.cloud:spring-cloud-function-context | >= 3.2.10, <= 3.2.15 | — | GHSA-x9c7-5h6g-hq8q |
| Maven | org.springframework.cloud:spring-cloud-function-context | >= 4.1.0, <= 4.1.9 | — | GHSA-x9c7-5h6g-hq8q |
| Maven | org.springframework.cloud:spring-cloud-function-context | >= 4.2.0, <= 4.2.5 | — | GHSA-x9c7-5h6g-hq8q |
Advisories 1
- WID-SEC-2026-1436 VMware Tanzu Spring Cloud Function: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jun 1, 2026