{"id":"CVE-2026-40990","aliases":["EUVD-2026-33734","GHSA-x4h3-g2x4-8gqv"],"status":"published","title":"Unbounded cache for function definitions","description":"OOM error is possible while attempting to add infinite amount of functions to Function Registry.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00211,"percentile":0.11444,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-06-01T17:49:16Z","modified":"2026-10-28T02:31:08Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","fixed_in":["4.3.3","5.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.10"},{"last_affected":"3.2.15"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"last_affected":"4.1.9"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"last_affected":"4.2.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}]}],"versions":["4.3.0","4.3.1","4.3.2"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.0.2"}]}],"versions":["5.0.0","5.0.1"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.10"},{"last_affected":"3.2.15"}]}],"versions":["3.2.10","3.2.11","3.2.12"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"last_affected":"4.1.9"}]}],"versions":["4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.cloud:spring-cloud-function-context","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"last_affected":"4.2.5"}]}],"versions":["4.2.0","4.2.1","4.2.2","4.2.3","4.2.4"]}],"products":[{"vendor":"spring","product":"spring cloud function"},{"vendor":"vmware","product":"spring_cloud_function"}],"references":[{"url":"https://spring.io/security/cve-2026-40990","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40990","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x4h3-g2x4-8gqv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40990.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40990","title":"Unbounded cache for function definitions","description":"OOM error is possible while attempting to add infinite amount of functions to Function Registry.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T17:49:16.377Z","modified":"2026-06-01T19:35:34.505Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-33734","description":"OOM error is possible while attempting to add infinite amount of functions to Function Registry.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T17:49:16Z","modified":"2026-06-01T19:35:34Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:57.828765Z"}],"ghsa":[{"id":"GHSA-x4h3-g2x4-8gqv","title":"Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry","description":"OOM error is possible while attempting to add infinite amount of functions to Function Registry.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T21:30:42Z","modified":"2026-07-09T13:38:33Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:41.501474Z"}],"nvd":[{"id":"CVE-2026-40990","description":"OOM error is possible while attempting to add infinite amount of functions to Function Registry.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T19:16:39.75Z","modified":"2026-07-22T07:10:00.107Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:21.635958Z"}],"osv":[{"id":"CVE-2026-40990","title":"Unbounded cache for function definitions","description":"OOM error is possible while attempting to add infinite amount of functions to Function Registry.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T17:49:16.377Z","modified":"2026-10-28T02:31:08.637710524Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"GHSA-x4h3-g2x4-8gqv","title":"Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry","description":"OOM error is possible while attempting to add infinite amount of functions to Function Registry.\n\nAffected Spring Products and Versions:\nSpring Cloud Function 3.2.x: versions prior to 3.2.16\nSpring Cloud Function 4.1.x: versions prior to 4.1.10\nSpring Cloud Function 4.2.x: versions prior to 4.2.6\nSpring Cloud Function 4.3.x: versions prior to 4.3.3\nSpring Cloud Function 5.0.x: versions prior to 5.0.2\nOlder, unsupported versions are also affected.","status":"published","published":"2026-06-01T21:30:42Z","modified":"2026-07-09T13:56:44.099686Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:59.484835Z"}]}}