CVE-2026-59298: Improper Input Validation

Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

PT-2026-82706

Name of the Vulnerable Software and Affected Versions Spring Cloud Function versions 5.0.0 through 5.0.3 Spring Cloud Function versions 4.3.0 through 4.3.4 Spring Cloud Function versions 4.2.0 through 4.2.7 Spring Cloud Function versions 3.2.16 and earlier Description There is a potential for...

PT-2026-82709

Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

PT-2026-82708

Name of the Vulnerable Software and Affected Versions Spring Cloud Function versions 5.0.0 through 5.0.3 Spring Cloud Function versions 4.3.0 through 4.3.4 Spring Cloud Function versions 4.2.0 through 4.2.7 Spring Cloud Function versions 3.2.16 and earlier Description Spring Cloud Function AWS...

CVE-2026-59301: Insertion of Sensitive Information into Log File

Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

PT-2026-82705

Implementation of isSecure call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

CVE-2026-59300: Insertion of Sensitive Information into Log File

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

CVE-2026-59291: Server-Side Request Forgery (SSRF)

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...

PT-2026-82707

Name of the Vulnerable Software and Affected Versions Spring Cloud Function versions 5.0.0 through 5.0.3 Spring Cloud Function versions 4.3.0 through 4.3.4 Spring Cloud Function versions 4.2.0 through 4.2.7 Spring Cloud Function versions 3.2.16 and earlier Description Composition lookup can...

CVE-2026-59299: Modification of Assumed-Immutable Data (MAID)

Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...

PT-2026-82701

Name of the Vulnerable Software and Affected Versions Spring Cloud Function versions 5.0.0 through 5.0.3 Spring Cloud Function versions 4.3.0 through 4.3.4 Spring Cloud Function versions 4.2.0 through 4.2.7 Description An issue exists that may allow arbitrary file read and Server-Side Request...

Exploit for Code Injection in Vmware Spring_Cloud_Function

No d...

CVE-2026-59291

CVE-2026-59291...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging process. An attacker can access sensitive information by triggering specific log events under certain conditions. Remediation Upgrade...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the function that processes input data. An attacker can access arbitrary files or make unauthorized network requests by supplying crafted input that is improperly handled. Remediation Upgrade...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the isSecure function of ServerlessHttpServletRequest due to not verifying the actual scheme. An attacker can potentially access or modify sensitive information by exploiting this improper security che...

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting in the processing of HTTP headers. An attacker can inject or manipulate HTTP headers by sending specially crafted requests. Remediation Upgrade org.springframework.cloud:spring-cloud-function-web to version 5.0.4...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' through the composition lookup. An attacker can manipulate the base function by injecting malicious components during the lookup process,...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the logging process. An attacker can obtain sensitive information by accessing logs that may inadvertently contain confidential data. Remediation Upgrade...

CVE-2026-40990

A flaw was found in Spring Cloud Function. A local attacker with low privileges could exploit this vulnerability by repeatedly adding functions to the Function Registry, leading to an Out Of Memory OOM error. This resource exhaustion can cause a Denial of Service DoS for the affected application...