PT-2026-45514 · Vmware · Spring Cloud Function

CVE-2026-40989 · Published 2026-06-01 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Spring Cloud Function versions prior to 3.2.16 Spring Cloud Function versions prior to 4.1.10 Spring Cloud Function versions prior to 4.2.6 Spring Cloud Function versions prior to 4.3.3 Spring Cloud Function versions prior to 5.0.2 Spring Cloud Function versions prior to 3.2.0

Description Infinite recursion within the routing layer during request-handling can lead to an Out of Memory (OOM) error, which occurs when the system exhausts its available RAM and cannot allocate more memory for operations.

Recommendations Update to version 3.2.16 or later. Update to version 4.1.10 or later. Update to version 4.2.6 or later. Update to version 4.3.3 or later. Update to version 5.0.2 or later.

Exploit

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-40989

GHSA-X9C7-5H6G-HQ8Q

Affected Products

Spring Cloud Function

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40989.json · Exploit
• https://osv.dev/vulnerability/GHSA-x9c7-5h6g-hq8q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40989 · Security Note
• https://osv.dev/vulnerability/CVE-2026-40989 · Vendor Advisory
• https://spring.io/security/cve-2026-40989 · Vendor Advisory
• https://github.com/spring-cloud/spring-cloud-function/commit/6bcd55803c5a2ce0adec794fee1e03c2fac36cf9 · Note
• https://github.com/spring-cloud/spring-cloud-function · Note
• https://t.me/cveNotify/166190 · Telegram Post
• https://t.me/cveNotify/165640 · Telegram Post