5.7
Medium
CVE-2026-40990 OOM error is possible while attempting to add infinite amount of functions to Function Registry
Description
OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Cloud Function 5.0 | 5.0.0 → < 5.0.2 | 5.0.2 |
| Spring Cloud Function 4.3 | 4.3.0 → < 4.3.3 | 4.3.3 |
| Spring Cloud Function 4.2 | 4.2.0 → < 4.2.6 | 4.2.6 |
| Spring Cloud Function 4.1 | 4.1.0 → < 4.1.10 | 4.1.10 |
| Spring Cloud Function 3.2 | 3.2.0 → < 3.2.16 | 3.2.16 |
Other CVEs of Spring Cloud Function
The 8 CVEs of Spring Cloud Function →
CVE-2026-59301
Potential for logging sensitive data in Spring Cloud Function Azure
3.1
Low
CVE-2026-59300
Potential for logging sensitive data in Spring Cloud Function AWS
3.1
Low
CVE-2026-59299
Composition lookup can potentially poison base function in Spring Cloud Function
3.1
Low
CVE-2026-59298
Potential for improper filtering of HTTP headers in Spring Cloud Function
3.1
Low