Executive brief
Spring Cloud Function is a framework used to build business logic as isolated functions that can run on cloud platforms. A vulnerability in the way it manages these functions could allow an attacker to crash the application by exhausting its memory. This results in a service outage, preventing the application from processing legitimate requests.
Technical details
A vulnerability exists in Spring Cloud Function's Function Registry component where uncontrolled recursion can occur. This issue is triggered when an attacker attempts to add an infinite or excessive number of functions to the registry, leading to an Out-of-Memory (OOM) condition. According to the vendor's CVSS metrics, exploitation requires physical access, low privileges, and user interaction, though NVD's alternative assessment suggests a network vector. The flaw is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). Patches are available in versions 3.2.16, 4.1.10, 4.2.6, 4.3.3, and 5.0.2.
Affected products
- VMware Spring Cloud Function 3.2.x prior to 3.2.16, 4.1.x prior to 4.1.10, 4.2.x prior to 4.2.6, 4.3.x prior to 4.3.3, 5.0.x prior to 5.0.2
Timeline
- 2026-06-01: disclosed
- 2026-06-01: advisory