CVE-2026-40990mediumCWE-770

CVE-2026-40990: falha de média gravidade em Spring Cloud Function

Unbounded cache for function definitions

Publicada em

Seguir esta CVE+ Monitorar Spring Cloud Function+ Monitorar org.springframework.cloud:spring-cloud-function-context

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.7epss 0.2%
OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H
Produtos afetados
Spring · Spring Cloud Function
CVEs relacionadas — Spring Cloud Function

No mesmo produto, das mais perigosas para as menos.

CVE-2026-59291LOWPotential arbitrary file read and SSRF vulnerability in Spring Cloud FunctionEPSS 0.2%CVE-2026-59301LOWPotential for logging sensitive data in Spring Cloud Function AzureEPSS 0.2%CVE-2026-59298LOWPotential for improper filtering of HTTP headers in Spring Cloud FunctionEPSS 0.2%CVE-2026-59300LOWPotential for logging sensitive data in Spring Cloud Function AWSEPSS 0.2%CVE-2026-59299LOWComposition lookup can potentially poison base function in Spring Cloud FunctionEPSS 0.2%CVE-2026-40989MEDIUMSelf Routing guard bypassed via function compositionEPSS 0.2%