Skip to content

Product

org.springframework.cloud/spring-cloud-function-context vulnerabilities

4 published CVES affecting org.springframework.cloud/spring-cloud-function-context, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
1
High
1
Medium
2
Low
0
Unscored
0
CISA KEV
1

Latest org.springframework.cloud/spring-cloud-function-context CVEs

Newest publication first

  1. CVE-2026-40990 Unbounded cache for function definitions

    Published
    MediumCVSS 5.7

    OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: version...

  2. CVE-2026-40989 Self Routing guard bypassed via function composition

    Published
    MediumCVSS 5.7

    Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4...

  3. CVE-2022-22963 Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

    Published
    CriticalCVSS 9.8 EPSS 99.9% CISA KEV added 2022-08-25 Exploited in the wild Framework module Public exploit PoC

    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.