Executive brief
Spring Cloud Function, a framework used to build cloud-native functions, is vulnerable to a denial-of-service condition. An attacker can trigger a recursive loop within the system's routing layer, causing the application to run out of memory and crash. This can lead to service outages and impact business operations that rely on these automated functions.
Technical details
A vulnerability classified as Uncontrolled Recursion (CWE-674) exists in the routing layer of Spring Cloud Function. The issue stems from how the FunctionRegistry handles recursive composition and request routing. An authenticated attacker can exploit this by sending specifically crafted requests that trigger infinite recursion, leading to an Out of Memory (OOM) error and a subsequent Denial of Service (DoS). While some advisory sources suggest physical access requirements, the NVD assessment indicates a network-based attack vector is possible with low privileges. Patches have been released across multiple major versions (3.2.16, 4.1.10, 4.2.6, 4.3.3, and 5.0.2).
Affected products
- VMware Spring Cloud Function 3.2.x prior to 3.2.16, 4.1.x prior to 4.1.10, 4.2.x prior to 4.2.6, 4.3.x prior to 4.3.3, 5.0.x prior to 5.0.2
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory