Spring Cloud Function vulnerabilities

Latest Spring Cloud Function CVEs

Newest publication first

1. CVE-2026-59301 Potential for logging sensitive data in Spring Cloud Function Azure

   Published 2026-08-27

   Low·CVSS 3.1

   Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

2. CVE-2026-59300 Potential for logging sensitive data in Spring Cloud Function AWS

   Published 2026-08-27

   Low·CVSS 3.1

   Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

3. CVE-2026-59299 Composition lookup can potentially poison base function in Spring Cloud Function

   Published 2026-08-27

   Low·CVSS 3.1

   Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

4. CVE-2026-59298 Potential for improper filtering of HTTP headers in Spring Cloud Function

   Published 2026-08-27

   Low·CVSS 3.1

   Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

5. CVE-2026-59297 Spring Cloud Function can incorrectly determine if URI is secure

   Published 2026-08-27

   Low·CVSS 3.1

   Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

6. CVE-2026-59291 Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function

   Published 2026-08-27

   Low·CVSS 2.0

   Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

7. CVE-2026-40990 Unbounded cache for function definitions

   Published 2026-06-01

   Medium·CVSS 5.7

   OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: version...

8. CVE-2026-40989 Self Routing guard bypassed via function composition

   Published 2026-06-01

   Medium·CVSS 5.7

   Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.