ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=9.3.0) +558 more potentially affected by CVE-2026-59291 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=5.0.3)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =3.5.5.2 and more Source cves: CVE-2026-59291https...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.3.0), cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.1.0.1) +275 more potentially affected by CVE-2026-59299 via org.springframework.cloud:spring-cloud-function-context (>=5.0.0-m1, <=5.0.3)

org.springframework.cloud:spring-cloud-function-context MAVEN version =5.0.0-m1, =8.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =1.0.0, =1.0.0, =1.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 and more Source cves: CVE-2026-59299 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-19267413...

CVE-2026-40990

A flaw was found in Spring Cloud Function. A local attacker with low privileges could exploit this vulnerability by repeatedly adding functions to the Function Registry, leading to an Out Of Memory OOM error. This resource exhaustion can cause a Denial of Service DoS for the affected application...

CVE-2026-40989

A flaw was found in Spring Cloud Function. An attacker could send a specially crafted request that triggers infinite recursion in the routing layer. This can lead to an Out Of Memory OOM error, causing a Denial of Service DoS condition where the application becomes unresponsive...

Denial Of Service (DoS)

Spring Cloud Function is vulnerable to Denial of Service DoS. The vulnerability is due to insufficient restrictions on function registration within the Function Registry, allowing an attacker to register an unbounded number of functions and trigger excessive memory consumption, potentially...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.39.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=6.0.0, <=7.4.5) +184 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.3.0, =17.39.0, =6.0.0, =2025.0.0.0, =2025.0.0.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =0.2.0, =0.2.1 - com.github.ggreen:split-json-array-processor 0.0.1 and more Source cves: CVE-2026-40989 Source advisory:...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40990...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.structured:structure-app-application (>=v2.0.0, <=2.0.1) +205 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=5.0.0, <=5.0.1)

org.springframework.cloud:spring-cloud-function-context MAVEN version =5.0.0, =8.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 - cn.structured:structure-audit-interfaces v2.0.0 -...

Spring Cloud Function Context has Uncontrolled Recursion

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud...

Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6...

GHSA-X4H3-G2X4-8GQV Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.39.0, <=18.5.0), ch.sbb:spring-cloud-stream-binder-solace (>=6.0.0, <=7.4.5) +184 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.3.0, <=4.3.2)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.3.0, =17.39.0, =6.0.0, =2025.0.0.0, =2025.0.0.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =5.23.0, =0.2.0, =0.2.1 - com.github.ggreen:split-json-array-processor 0.0.1 and more Source cves: CVE-2026-40990 Source advisory:...

ch.admin.bit.jeap:jeap-spring-boot-config-starter (>=17.16.0, <=17.38.0), ch.sbb:spring-cloud-stream-binder-solace (>=5.0.5, <=5.2.0) +356 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=4.2.0, <=4.2.4)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.2.0, =17.16.0, =5.0.5, =3.5.5.3, =3.4.0.0, =3.5.5.3, =3.5.5.3, =3.4.0.0, =3.4.0.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =5.19.0, =1.16.0,...

cn.herodotus.engine:event-message-spring-boot-starter (>=2.7.11.1, <=2.7.18.final), com.azure.spring:spring-cloud-azure-starter-stream-eventhubs (>=4.8.0, <=4.20.0) +113 more potentially affected by CVE-2026-40990 via org.springframework.cloud:spring-cloud-function-context (>=3.2.10, <=3.2.12)

org.springframework.cloud:spring-cloud-function-context MAVEN version =3.2.10, =2.7.11.1, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =4.8.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 - com.findevglobal:spring-cloud-stream-binder-amps 1.0.0 - com.findevglobal:spring-cloud-stream-tracer-a...

GHSA-X9C7-5H6G-HQ8Q Spring Cloud Function Context has Uncontrolled Recursion

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40989...

ch.sbb:spring-cloud-stream-binder-solace (>=4.0.0, <=5.0.3), city.hiperium:cities-functions-parent-pom (>=1.0.0, <=1.0.5) +640 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=4.1.0, <=4.1.6)

org.springframework.cloud:spring-cloud-function-context MAVEN version =4.1.0, =4.0.0, =1.0.0, =1.0.1, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.2.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =2023.0.0.0-rc1, =2023.0.0.0-rc1, =2023.0.3.4 and more Source cves: CVE-2026-40989...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.structured:structure-app-application (>=v2.0.0, <=2.0.1) +205 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=5.0.0, <=5.0.1)

org.springframework.cloud:spring-cloud-function-context MAVEN version =5.0.0, =8.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 - cn.structured:structure-audit-interfaces v2.0.0 -...

ch.sbb:spring-cloud-stream-binder-solace (>=8.0.0, <=9.0.2), cn.structured:structure-app-application (>=v2.0.0, <=2.0.1) +205 more potentially affected by CVE-2026-40989 via org.springframework.cloud:spring-cloud-function-context (>=5.0.0, <=5.0.1)

org.springframework.cloud:spring-cloud-function-context MAVEN version =5.0.0, =8.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =v2.0.0, =2.0.1 - cn.structured:structure-audit-application v2.0.0 - cn.structured:structure-audit-infra v2.0.0 - cn.structured:structure-audit-interfaces v2.0.0 -...