CVE-2026-40989 Details
Description
Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
A denial-of-service vulnerability has been identified in VMware Spring Cloud Function. Under certain conditions, infinite recursion in the routing layer can lead to out-of-memory errors. This issue affects Spring Cloud Function versions 3.2.x prior to 3.2.16, 4.1.x prior to 4.1.10, 4.2.x prior to 4.2.6, 4.3.x prior to 4.3.3, 5.0.x prior to 5.0.2, and older, unsupported versions.
Users of affected versions should upgrade to the corresponding fixed version. For versions 3.2.x, 4.1.x, 4.2.x, and 4.3.x, the fixed versions are available through the Spring Enterprise Support. For version 5.0.x, the fixed version is available as open-source.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://spring.io/security/cve-2026-40989 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vmware spring cloud function | >= 3.2.0, < 3.2.16 >= 4.1.0, < 4.1.10 >= 4.2.0, < 4.2.6 >= 4.3.0, < 4.3.3 >= 5.0.0, < 5.0.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | Initial Analysis | [email protected] |
| Jun 1, 2026 | New CVE Received | [email protected] |