Executive brief
Spring Cloud Function is a framework used to build serverless applications and microservices. A vulnerability in composition lookup allows attackers to potentially poison base functions, which could lead to unexpected behavior, code execution, or disruption of function processing. Organizations using Spring Cloud Function for critical services may experience service degradation or unauthorized function replacement.
Technical details
The vulnerability exists in the composition lookup mechanism of Spring Cloud Function, which allows functions to be chained together. An attacker can craft requests that poison the base function during composition resolution, causing the framework to use an unintended function. The attack is reachable over the network and does not require authentication. This could lead to arbitrary function invocation or redirection of function calls to attacker-controlled handlers. Patches are available for affected versions.
Affected products
- Spring Cloud Function 3.2.16 and earlier, 4.2.0–4.2.7, 4.3.0–4.3.4, 5.0.0–5.0.3
Timeline
- 2026-08-27: disclosed