PT-2024-7898 · Spring · Spring Cloud Function

Devme4F · Published 2024-07-09 · Updated 2025-12-28 · CVE-2024-22271

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Spring Cloud Function versions 4.0.x prior to 4.0.8 Spring Cloud Function versions 4.1.x prior to 4.1.2

Description The issue is related to insufficient input validation in the Spring Cloud Function web module. This can be exploited by a remote attacker to perform a denial-of-service attack.

Recommendations For Spring Cloud Function versions 4.0.x prior to 4.0.8, update to version 4.0.8 or later. For Spring Cloud Function versions 4.1.x prior to 4.1.2, update to version 4.1.2 or later.

Fix

LPE

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-09402

CVE-2024-22271

GHSA-J4R7-P9FP-W3F3

Affected Products

Spring Cloud Function

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-22271 · Security Note
• https://bdu.fstec.ru/vul/2024-09402 · Security Note
• https://osv.dev/vulnerability/GHSA-j4r7-p9fp-w3f3 · Vendor Advisory
• https://github.com/spring-cloud/spring-cloud-function/releases/tag/v4.1.2 · Note
• https://github.com/spring-cloud/spring-cloud-function/commit/59fe298b67fcb9249db727a7b3a33612fc7a9f75 · Note
• https://github.com/spring-cloud/spring-cloud-function/issues/1139 · Note
• https://github.com/spring-cloud/spring-cloud-function · Note
• https://t.me/cvedetector/349 · Telegram Post
• https://vuldb.com/?id.270689 · Note
• https://t.me/cvenotify/85518 · Telegram Post
• https://spring.io/security/cve-2024-22271 · Note
• https://twitter.com/AnonNews_irc/status/2005101266448388573 · Twitter Post
• https://twitter.com/CVEnew/status/1810658953832927489 · Twitter Post
• https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation · Note
• https://twitter.com/VulmonFeeds/status/1810683832657490045 · Twitter Post