Vulnerability-Lookup

CVE-2026-40989 (GCVE-0-2026-40989)

Vulnerability from cvelistv5 – Published: 2026-06-01 17:49 – Updated: 2026-06-01 19:35

Title

Self Routing guard bypassed via function composition

Summary

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-01 19:34 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

vmware mitre root

References

1 reference

URL	Tags
https://spring.io/security/cve-2026-40989

Impacted products

1 product

Vendor	Product	Version	CPE status
Spring	Spring Cloud Function	Affected: 3.2.0 , < 3.2.16 (custom) Affected: 4.1.0 , < 4.1.10 (custom) Affected: 4.2.0 , < 4.2.6 (custom) Affected: 4.3.0 , < 4.3.3 (custom) Affected: 5.0.0 , < 5.0.2 (custom)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T19:34:59.555964Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T19:35:11.824Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Function",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.10",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.6",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.3",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.0.2",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Under infinite recursion in the routing layer, request-handling can cause OOM error.\u003cbr\u003e\u003cbr\u003eAffected Spring Products and Versions:\u003cbr\u003eSpring Cloud Function 3.2.x: versions prior to 3.2.16\u003cbr\u003eSpring Cloud Function 4.1.x: versions prior to 4.1.10\u003cbr\u003eSpring Cloud Function 4.2.x: versions prior to 4.2.6\u003cbr\u003eSpring Cloud Function 4.3.x: versions prior to 4.3.3\u003cbr\u003eSpring Cloud Function 5.0.x: versions prior to 5.0.2\u003cbr\u003eOlder, unsupported versions are also affected."
            }
          ],
          "value": "Under infinite recursion in the routing layer, request-handling can cause OOM error.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Under infinite recursion in the routing layer, request-handling can cause an OOM error, leading to denial of service."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674 Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T17:49:14.102Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "url": "https://spring.io/security/cve-2026-40989"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Self Routing guard bypassed via function composition"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2026-40989",
    "datePublished": "2026-06-01T17:49:14.102Z",
    "dateReserved": "2026-04-16T02:19:09.389Z",
    "dateUpdated": "2026-06-01T19:35:11.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-40989",
      "date": "2026-09-15",
      "epss": "0.00211",
      "percentile": "0.11543"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-40989\",\"sourceIdentifier\":\"security@vmware.com\",\"published\":\"2026-06-01T19:16:39.583\",\"lastModified\":\"2026-07-22T07:10:00.107\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Under infinite recursion in the routing layer, request-handling can cause OOM error.\\n\\nAffected Spring Products and Versions:\\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\\nOlder, unsupported versions are also affected.\"},{\"lang\":\"es\",\"value\":\"Bajo recursi\u00f3n infinita en la capa de enrutamiento, el manejo de solicitudes puede causar un error OOM.\\n\\nProductos y versiones de Spring afectados:\\nSpring Cloud Function 3.2.x: versiones anteriores a 3.2.16\\nSpring Cloud Function 4.1.x: versiones anteriores a 4.1.10\\nSpring Cloud Function 4.2.x: versiones anteriores a 4.2.6\\nSpring Cloud Function 4.3.x: versiones anteriores a 4.3.3\\nSpring Cloud Function 5.0.x: versiones anteriores a 5.0.2\\nLas versiones antiguas y sin soporte tambi\u00e9n est\u00e1n afectadas.\"}],\"affected\":[{\"source\":\"security@vmware.com\",\"affectedData\":[{\"vendor\":\"Spring\",\"product\":\"Spring Cloud Function\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.2.0\",\"lessThan\":\"3.2.16\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.1.0\",\"lessThan\":\"4.1.10\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.2.0\",\"lessThan\":\"4.2.6\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"4.3.0\",\"lessThan\":\"4.3.3\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"5.0.0\",\"lessThan\":\"5.0.2\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.5,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-01T19:34:59.555964Z\",\"id\":\"CVE-2026-40989\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@vmware.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-674\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2.0\",\"versionEndExcluding\":\"3.2.16\",\"matchCriteriaId\":\"2766E262-1F05-45E7-B3F3-75867B38084E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.1.0\",\"versionEndExcluding\":\"4.1.10\",\"matchCriteriaId\":\"0C4D2A35-3B2F-4300-8ACE-4B75457FF04A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2.0\",\"versionEndExcluding\":\"4.2.6\",\"matchCriteriaId\":\"56B80C9B-5EFB-4C20-BA2B-EB42F494677F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.3.0\",\"versionEndExcluding\":\"4.3.3\",\"matchCriteriaId\":\"C12C5C92-E11F-448E-A5B7-02A0AE2761BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.0\",\"versionEndExcluding\":\"5.0.2\",\"matchCriteriaId\":\"04E18D84-D818-40B7-BD22-43C946286A2A\"}]}]}],\"references\":[{\"url\":\"https://spring.io/security/cve-2026-40989\",\"source\":\"security@vmware.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-01T04:38:32+00:00",
      "cve": "CVE-2026-40989",
      "id": "CVE-2026-40989",
      "initial_release_date": "2026-06-01T17:49:14.102000+00:00",
      "product_status:known_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "spring-cloud-function-context: Spring Cloud Function: Denial of Service via infinite recursion in routing layer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40989.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-40989\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-01T19:34:59.555964Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-01T19:35:06.936Z\"}}], \"cna\": {\"title\": \"Self Routing guard bypassed via function composition\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Under infinite recursion in the routing layer, request-handling can cause an OOM error, leading to denial of service.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.7, \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Spring\", \"product\": \"Spring Cloud Function\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.2.0\", \"lessThan\": \"3.2.16\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.1.0\", \"lessThan\": \"4.1.10\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.2.0\", \"lessThan\": \"4.2.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.0\", \"lessThan\": \"4.3.3\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.0.0\", \"lessThan\": \"5.0.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://spring.io/security/cve-2026-40989\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Under infinite recursion in the routing layer, request-handling can cause OOM error.\\n\\nAffected Spring Products and Versions:\\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\\nOlder, unsupported versions are also affected.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Under infinite recursion in the routing layer, request-handling can cause OOM error.\u003cbr\u003e\u003cbr\u003eAffected Spring Products and Versions:\u003cbr\u003eSpring Cloud Function 3.2.x: versions prior to 3.2.16\u003cbr\u003eSpring Cloud Function 4.1.x: versions prior to 4.1.10\u003cbr\u003eSpring Cloud Function 4.2.x: versions prior to 4.2.6\u003cbr\u003eSpring Cloud Function 4.3.x: versions prior to 4.3.3\u003cbr\u003eSpring Cloud Function 5.0.x: versions prior to 5.0.2\u003cbr\u003eOlder, unsupported versions are also affected.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-674\", \"description\": \"CWE-674 Uncontrolled Recursion\"}]}], \"providerMetadata\": {\"orgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"shortName\": \"vmware\", \"dateUpdated\": \"2026-06-01T17:49:14.102Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-40989\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-01T19:35:11.824Z\", \"dateReserved\": \"2026-04-16T02:19:09.389Z\", \"assignerOrgId\": \"dcf2e128-44bd-42ed-91e8-88f912c1401d\", \"datePublished\": \"2026-06-01T17:49:14.102Z\", \"assignerShortName\": \"vmware\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-0554

Vulnerability from certfr_avis - Published: 2026-05-11 - Updated: 2026-05-11

De multiples vulnérabilités ont été découvertes dans les produits Spring. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Spring	Spring AI	Spring versions 1.0.x antérieures à 1.0.7
Spring	Cloud Function Framework	Cloud Function versions 4.3.x antérieures à 4.3.3
Spring	Cloud Function Framework	Cloud Function versions 4.2.x antérieures à 4.2.6
Spring	Cloud Function Framework	Cloud Function versions 4.1.x antérieures à 4.1.10
Spring	Cloud Function Framework	Cloud Function versions 3.2.x antérieures à 3.2.16
Spring	Cloud Function Framework	Cloud Function versions 5.0.x antérieures à 5.0.2
Spring	Spring AI	Spring versions 1.1.x antérieures à 1.1.6

References

Title

Publication Time

FKIE_CVE-2026-40989

Vulnerability from fkie_nvd - Published: 2026-06-01 19:16 - Updated: 2026-07-22 07:10

Severity

5.7 (Medium) - CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security@vmware.com	https://spring.io/security/cve-2026-40989	Vendor Advisory

Impacted products

Vendor	Product	Version
vmware	spring_cloud_function	*
vmware	spring_cloud_function	*
vmware	spring_cloud_function	*
vmware	spring_cloud_function	*
vmware	spring_cloud_function	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Spring Cloud Function",
          "vendor": "Spring",
          "versions": [
            {
              "lessThan": "3.2.16",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.10",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.6",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.3",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.0.2",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "security@vmware.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2766E262-1F05-45E7-B3F3-75867B38084E",
              "versionEndExcluding": "3.2.16",
              "versionStartIncluding": "3.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C4D2A35-3B2F-4300-8ACE-4B75457FF04A",
              "versionEndExcluding": "4.1.10",
              "versionStartIncluding": "4.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "56B80C9B-5EFB-4C20-BA2B-EB42F494677F",
              "versionEndExcluding": "4.2.6",
              "versionStartIncluding": "4.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C12C5C92-E11F-448E-A5B7-02A0AE2761BF",
              "versionEndExcluding": "4.3.3",
              "versionStartIncluding": "4.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "04E18D84-D818-40B7-BD22-43C946286A2A",
              "versionEndExcluding": "5.0.2",
              "versionStartIncluding": "5.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Under infinite recursion in the routing layer, request-handling can cause OOM error.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected."
    },
    {
      "lang": "es",
      "value": "Bajo recursi\u00f3n infinita en la capa de enrutamiento, el manejo de solicitudes puede causar un error OOM.\n\nProductos y versiones de Spring afectados:\nSpring Cloud Function 3.2.x: versiones anteriores a 3.2.16\nSpring Cloud Function 4.1.x: versiones anteriores a 4.1.10\nSpring Cloud Function 4.2.x: versiones anteriores a 4.2.6\nSpring Cloud Function 4.3.x: versiones anteriores a 4.3.3\nSpring Cloud Function 5.0.x: versiones anteriores a 5.0.2\nLas versiones antiguas y sin soporte tambi\u00e9n est\u00e1n afectadas."
    }
  ],
  "id": "CVE-2026-40989",
  "lastModified": "2026-07-22T07:10:00.107",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 4.7,
        "source": "security@vmware.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40989",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-01T19:34:59.555964Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-01T19:16:39.583",
  "references": [
    {
      "source": "security@vmware.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://spring.io/security/cve-2026-40989"
    }
  ],
  "sourceIdentifier": "security@vmware.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ],
      "source": "security@vmware.com",
      "type": "Secondary"
    }
  ]
}

GHSA-X9C7-5H6G-HQ8Q

Vulnerability from github – Published: 2026-06-01 21:30 – Updated: 2026-07-09 13:38

Summary

Spring Cloud Function Context has Uncontrolled Recursion

Details

Under infinite recursion in the routing layer, request-handling can cause OOM error.

Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

Severity

5.7 (Medium)


                  
                    CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-function-context"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.3.0"
            },
            {
              "fixed": "4.3.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-function-context"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-function-context"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.2.10"
            },
            {
              "last_affected": "3.2.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-function-context"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "last_affected": "4.1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.springframework.cloud:spring-cloud-function-context"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "last_affected": "4.2.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-40989"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T13:38:38Z",
    "nvd_published_at": "2026-06-01T19:16:39Z",
    "severity": "MODERATE"
  },
  "details": "Under infinite recursion in the routing layer, request-handling can cause OOM error.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.",
  "id": "GHSA-x9c7-5h6g-hq8q",
  "modified": "2026-07-09T13:38:38Z",
  "published": "2026-06-01T21:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40989"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spring-cloud/spring-cloud-function/commit/6bcd55803c5a2ce0adec794fee1e03c2fac36cf9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spring-cloud/spring-cloud-function"
    },
    {
      "type": "WEB",
      "url": "https://spring.io/security/cve-2026-40989"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Spring Cloud Function Context has Uncontrolled Recursion"
}

WID-SEC-W-2026-1436

Vulnerability from csaf_certbund - Published: 2026-05-07 22:00 - Updated: 2026-06-01 22:00

Summary

VMware Tanzu Spring Cloud Function: Mehrere Schwachstellen ermöglichen Denial of Service

Severity

Mittel

Scope

2 vulnerabilities in this advisory, including CVE-2026-40989.

CVE-2026-40989

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-40989 (GCVE-0-2026-40989)

CERTFR-2026-AVI-0554

Solutions

FKIE_CVE-2026-40989

GHSA-X9C7-5H6G-HQ8Q

WID-SEC-W-2026-1436

Tags

Sightings

Nomenclature

Related by attack behaviour