5.7Media
CVE-2026-40989Self Routing guard bypassed via function composition
Descripción
Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
Debilidad (CWE):
CWE-674
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Spring | Spring Cloud Function | 3.2.0 – < 3.2.16, 4.1.0 – < 4.1.10, 4.2.0 – < 4.2.6, 4.3.0 – < 4.3.3, 5.0.0 – < 5.0.2 | |
| vmware | spring cloud function | 3.2.0 – < 3.2.16 |
Referencias y parches
- https://spring.io/security/cve-2026-40989 Vendor Advisory
Coincidencias CPE (NVD) (5)
cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.16cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.10cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.6cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*≥ 4.3.0 < 4.3.3cpe:2.3:a:vmware:spring_cloud_function:*:*:*:*:*:*:*:*≥ 5.0.0 < 5.0.2