NVD Vulnerability Detail
Search Exploit, PoC
CVE-2026-40989
Summary

Under infinite recursion in the routing layer, request-handling can cause OOM error.

Affected Spring Products and Versions:
Spring Cloud Function 3.2.x: versions prior to 3.2.16
Spring Cloud Function 4.1.x: versions prior to 4.1.10
Spring Cloud Function 4.2.x: versions prior to 4.2.6
Spring Cloud Function 4.3.x: versions prior to 4.3.3
Spring Cloud Function 5.0.x: versions prior to 5.0.2
Older, unsupported versions are also affected.

Publication Date June 2, 2026, 4:16 a.m.
Registration Date June 3, 2026, 4:14 a.m.
Last Update June 2, 2026, 11:01 p.m.
CVSS3.1 : MEDIUM
スコア 5.7
Vector CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H
攻撃元区分(AV) 物理
攻撃条件の複雑さ(AC)
攻撃に必要な特権レベル(PR)
利用者の関与(UI)
影響の想定範囲(S) 変更あり
機密性への影響(C) なし
完全性への影響(I)
可用性への影響(A)
Related information, measures and tools
Common Vulnerabilities List