Denial Of Service (DoS)

Spring Cloud Function is vulnerable to Denial of Service DoS. The vulnerability is due to insufficient restrictions on function registration within the Function Registry, allowing an attacker to register an unbounded number of functions and trigger excessive memory consumption, potentially...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +356 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.39.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=6.0.0, <=7.4.5) +184 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.3.0, =17.39.0, =6.0.0, =2025.0.0.0, =2025.0.0.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =0.2.0, =0.2.1 - com.github.ggreen:split-json-array-processor 0.0.1 and more Source cves: CVE-2026-40989 Source advisory:...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.39.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=6.0.0, <=7.4.5) +184 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.3.0, =17.39.0, =6.0.0, =2025.0.0.0, =2025.0.0.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =0.2.0, =0.2.1 - com.github.ggreen:split-json-array-processor 0.0.1 and more Source cves: CVE-2026-40989 Source advisory:...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

GHSA-X4H3-G2X4-8GQV Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.structured:structure-app-application (>=v2.0.0, <=2.0.1) +205 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=5.0.0, <=5.0.1)

org.springframework.cloud:spring-cloud-function-context MAVEN version =5.0.0, =8.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 - cn.structured:structure-audit-interfaces v2.0.0 -...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.39.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=6.0.0, <=7.4.5) +184 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.3.0, =17.39.0, =6.0.0, =2025.0.0.0, =2025.0.0.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =0.2.0, =0.2.1 - com.github.ggreen:split-json-array-processor 0.0.1 and more Source cves: CVE-2026-40990 Source advisory:...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.structured:structure-app-application (>=v2.0.0, <=2.0.1) +205 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=5.0.0, <=5.0.1)

org.springframework.cloud:spring-cloud-function-context MAVEN version =5.0.0, =8.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 - cn.structured:structure-audit-interfaces v2.0.0 -...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40990...

Spring Cloud Function Context has Uncontrolled Recursion

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud...

Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +356 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40989...

GHSA-X9C7-5H6G-HQ8Q Spring Cloud Function Context has Uncontrolled Recursion

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +356 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +356 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40989...