CVE-2026-40989 Self Routing guard bypassed via function composition
Attackers can cause out-of-memory errors and service disruption in Spring Cloud Function via infinite recursion in the routing layer.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-40989?
CVE-2026-40989 is a medium-severity denial of service vulnerability in Spring Cloud Function, published on 1 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Under infinite recursion in the routing layer, request-handling can cause OOM error.
Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
Weakness: CWE-674
Which versions are affected by CVE-2026-40989?
10 open source packages ship an affected version, including org.springframework.cloud:spring-cloud-function-context. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.cloud:spring-cloud-function-context Maven | From 3.2.10 to 3.2.15 | None |
org.springframework.cloud:spring-cloud-function-context Maven | From 3.2.10 to 3.2.15 | None |
org.springframework.cloud:spring-cloud-function-context Maven | From 4.1.0 to 4.1.9 | None |
org.springframework.cloud:spring-cloud-function-context Maven | From 4.1.0 to 4.1.9 | None |
org.springframework.cloud:spring-cloud-function-context Maven | From 4.2.0 to 4.2.5 | None |
org.springframework.cloud:spring-cloud-function-context Maven | From 4.2.0 to 4.2.5 | None |
4 more packages
org.springframework.cloud:spring-cloud-function-context Maven | From 4.3.0 | 4.3.3 |
org.springframework.cloud:spring-cloud-function-context Maven | From 4.3.0 | 4.3.3 |
org.springframework.cloud:spring-cloud-function-context Maven | From 5.0.0 | 5.0.2 |
org.springframework.cloud:spring-cloud-function-context Maven | From 5.0.0 | 5.0.2 |
Products include Vmware Spring Cloud Function.
How do I fix CVE-2026-40989?
Upgrade org.springframework.cloud:spring-cloud-function-context to a fixed version for your release line: 4.3.3 or 5.0.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-40989 being exploited?
There is no known exploitation of CVE-2026-40989 in the wild and no public exploit code.
Other vulnerabilities in Spring Cloud Function
- CVE-2022-22979 Denial of Service in Spring Cloud Function
- CVE-2026-40990 Unbounded cache for function definitions
- CVE-2026-59297 Spring Cloud Function can incorrectly determine if URI is secure
- CVE-2026-59298 Potential for improper filtering of HTTP headers in Spring Cloud Function
- CVE-2026-59299 Composition lookup can potentially poison base function in Spring Cloud Function
Sources
Also known as GHSA-x9c7-5h6g-hq8q.