Executive brief
Spring Cloud Function is used to build serverless applications that process HTTP requests. A flaw in the isSecure() method of ServerlessHttpServletRequest causes it to incorrectly report whether a request was made over HTTPS, potentially allowing attackers to bypass security checks that rely on verifying encrypted connections. This could lead to sensitive data being transmitted insecurely or security policies being circumvented.
Technical details
The ServerlessHttpServletRequest class in Spring Cloud Function versions 4.2.0–4.2.7, 4.3.0–4.3.4, and 5.0.0–5.0.3 implements an isSecure() method that fails to properly verify the actual HTTP scheme (http vs. https). This is a logic flaw in the request validation layer. The vulnerability allows an attacker with network access to a Spring Cloud Function endpoint to make requests that are falsely reported as secure, potentially bypassing downstream security controls that check request.isSecure(). No special authentication or user interaction is required. Patches are available in newer versions of Spring Cloud Function.
Affected products
- Spring Cloud Function 4.2.0 to 4.2.7, 4.3.0 to 4.3.4, 5.0.0 to 5.0.3
Timeline
- 2026-08-27: disclosed