PT-2026-45515 · Vmware · Spring Cloud Function

CVE-2026-40990 · Published 2026-06-01 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Spring Cloud Function versions prior to 3.2.16 Spring Cloud Function versions prior to 4.1.10 Spring Cloud Function versions prior to 4.2.6 Spring Cloud Function versions prior to 4.3.3 Spring Cloud Function versions prior to 5.0.2 Spring Cloud Function versions prior to 3.2.0

Description An Out of Memory (OOM) error can occur when attempting to add an infinite number of functions to the Function Registry. OOM is a state where a system cannot allocate enough memory to perform a requested operation, leading to application instability or crashes.

Recommendations Update to version 3.2.16 or later. Update to version 4.1.10 or later. Update to version 4.2.6 or later. Update to version 4.3.3 or later. Update to version 5.0.2 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-40990

GHSA-X4H3-G2X4-8GQV

Affected Products

Spring Cloud Function

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40990.json · Exploit
• https://spring.io/security/cve-2026-40990 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-40990 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40990 · Security Note
• https://osv.dev/vulnerability/GHSA-x4h3-g2x4-8gqv · Vendor Advisory
• https://t.me/cveNotify/166191 · Telegram Post
• https://t.me/cveNotify/165641 · Telegram Post