Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.springframework.cloud:spring-cloud-function-context

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.7MavenPublished

    Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

    CVE-2026-40990 · GHSA-x4h3-g2x4-8gqv

    Affected
    • Maven org.springframework.cloud:spring-cloud-function-context >= 4.3.0, < 4.3.3; >= 5.0.0, < 5.0.2; >= 3.2.10, <= 3.2.15; >= 4.1.0, <= 4.1.9; >= 4.2.0, <= 4.2.5
    Fixed in
    4.3.35.0.2· Partial vendor fix
    Issue
    OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

    Recommended action: Upgrade to 5.0.2 or 4.3.3 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 5.7MavenPublished

    Spring Cloud Function Context has Uncontrolled Recursion

    CVE-2026-40989 · GHSA-x9c7-5h6g-hq8q

    Affected
    • Maven org.springframework.cloud:spring-cloud-function-context >= 4.3.0, < 4.3.3; >= 5.0.0, < 5.0.2; >= 3.2.10, <= 3.2.15; >= 4.1.0, <= 4.1.9; >= 4.2.0, <= 4.2.5
    Fixed in
    4.3.35.0.2· Partial vendor fix
    Issue
    Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

    Recommended action: Upgrade to 5.0.2 or 4.3.3 by release line; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  3. High, CVSS 8.8MavenPublished

    Spring Cloud Function Framework vulnerable to Denial of Service

    CVE-2024-22271 · GHSA-j4r7-p9fp-w3f3

    Affected
    • Maven org.springframework.cloud:spring-cloud-function-context >= 4.0.0, < 4.0.8; >= 4.1.0, < 4.1.2
    Fixed in
    4.0.84.1.2· Vendor fix available
    Issue
    In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions. Specifically, an application is vulnerable when all of the following are true: User is using Spring Cloud Function Web module Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8 References https://spring.io/security/cve-2022-22979 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ History 2020-01-16: Initial vulnerability report published.

    Recommended action: Upgrade to 4.1.2 or 4.0.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  4. Critical, CVSS 9.8Exploited · CISA KEVMavenPublished

    Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

    CVE-2022-22963 · GHSA-6v73-fgf6-w5j7

    Affected
    • Maven org.springframework.cloud:spring-cloud-function-context >= 3.2.0, < 3.2.3; < 3.1.7
    Fixed in
    3.2.33.1.7· Vendor fix available
    Issue
    In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

    Recommended action: Upgrade to 3.2.3 or 3.1.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:cisa.gov (1)github.com (2)Source checked Evidence →