{"id":"CVE-2026-40989","aliases":["CLSA-2026-1793784426","CLSA-2026-1794229858","EUVD-2026-33733","GHSA-x9c7-5h6g-hq8q"],"status":"published","title":"Self Routing guard bypassed via function composition","description":"Under infinite recursion in the routing layer, request-handling can cause OOM error.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00211,"percentile":0.11444,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2026-06-01T17:49:14Z","modified":"2026-11-09T19:15:05Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","fixed_in":["4.3.3","5.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.10"},{"last_affected":"3.2.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"last_affected":"4.1.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"last_affected":"4.2.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.cloud:spring-cloud-function-adapter-aws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.12"},{"fixed":"3.2.12-tuxcare.1"}]}],"versions":["3.2.12"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.12"},{"fixed":"3.2.12-tuxcare.1"}]}],"versions":["3.2.12"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.cloud:spring-cloud-function-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.12"},{"fixed":"3.2.12-tuxcare.1"}]}],"versions":["3.2.12"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9.RELEASE"},{"fixed":"3.0.9.RELEASE-tuxcare.1"}]}],"versions":["3.0.9.RELEASE"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.cloud:spring-cloud-function-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9.RELEASE"},{"fixed":"3.0.9.RELEASE-tuxcare.1"}]}],"versions":["3.0.9.RELEASE"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.cloud:spring-cloud-function-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.9.RELEASE"},{"fixed":"3.0.9.RELEASE-tuxcare.1"}]}],"versions":["3.0.9.RELEASE"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}]}],"versions":["4.3.0","4.3.1","4.3.2"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.2"}]}],"versions":["5.0.0","5.0.1"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.10"},{"last_affected":"3.2.15"}]}],"versions":["3.2.10","3.2.11","3.2.12"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"last_affected":"4.1.9"}]}],"versions":["4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"last_affected":"4.2.5"}]}],"versions":["4.2.0","4.2.1","4.2.2","4.2.3","4.2.4"]}],"products":[{"vendor":"spring","product":"spring cloud function"},{"vendor":"vmware","product":"spring_cloud_function"}],"references":[{"url":"https://spring.io/security/cve-2026-40989","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40989","tags":["advisory"]},{"url":"https://github.com/spring-cloud/spring-cloud-function/commit/6bcd55803c5a2ce0adec794fee1e03c2fac36cf9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x9c7-5h6g-hq8q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40989.json","tags":["advisory"]},{"url":"https://github.com/spring-cloud/spring-cloud-function","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40989","title":"Self Routing guard bypassed via function composition","description":"Under infinite recursion in the routing layer, request-handling can cause OOM error.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T17:49:14.102Z","modified":"2026-06-01T19:35:11.824Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-33733","description":"Under infinite recursion in the routing layer, request-handling can cause OOM error.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T17:49:14Z","modified":"2026-06-01T19:35:11Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:57.828765Z"}],"ghsa":[{"id":"GHSA-x9c7-5h6g-hq8q","title":"Spring Cloud Function Context has Uncontrolled Recursion","description":"Under infinite recursion in the routing layer, request-handling can cause OOM error.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T21:30:42Z","modified":"2026-07-09T13:38:41Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:40:41.501474Z"}],"nvd":[{"id":"CVE-2026-40989","description":"Under infinite recursion in the routing layer, request-handling can cause OOM error.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T19:16:39.583Z","modified":"2026-07-22T07:10:00.107Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:12:21.635958Z"}],"osv":[{"id":"CVE-2026-40989","title":"Self Routing guard bypassed via function composition","description":"Under infinite recursion in the routing layer, request-handling can cause OOM error.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T17:49:14.102Z","modified":"2026-10-28T02:31:00.573405694Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"GHSA-x9c7-5h6g-hq8q","title":"Spring Cloud Function Context has Uncontrolled Recursion","description":"Under infinite recursion in the routing layer, request-handling can cause OOM error.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T21:30:42Z","modified":"2026-07-09T13:56:44.509439Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"CLSA-2026-1793784426","title":"TuxCare security update for org.springframework.cloud (4 CVEs)","description":"TuxCare rebuilt 3 org.springframework.cloud packages to address 4 CVEs. Fixed in 3.2.12-tuxcare.1.","status":"published","published":"2026-11-04T10:27:06Z","modified":"2026-11-04T14:45:06.147516742Z","updated_at":"2026-11-04T15:03:54.132276Z"},{"id":"CLSA-2026-1794229858","title":"TuxCare security update for org.springframework.cloud (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.cloud packages to address 3 CVEs. Fixed in 3.0.9.RELEASE-tuxcare.1.","status":"published","published":"2026-11-09T14:10:59Z","modified":"2026-11-09T19:15:05.8379088Z","updated_at":"2026-11-09T19:38:09.278998Z"}]}}