This vulnerability (CVE-2026-40989) involves uncontrolled recursion in the routing layer of Spring Cloud Function, which can cause the application to consume excessive memory and crash with an out-of-memory error. It affects Spring Cloud Function versions prior to 3.2.16, 4.1.10, 4.2.6, 4.3.3, and 5.0.2, including older unsupported versions. The CVSS score is 5.7 (medium severity) with an attack vector requiring physical access, low attack complexity, low privileges, and user interaction, impacting availability but not confidentiality or integrity. No vendor advisory or patch links are provided, and the remediation level is unknown.

The primary impact is a denial of service condition caused by an out-of-memory error triggered by infinite recursion in the routing layer. There is no direct impact on confidentiality or integrity. Exploitation requires local access and user interaction, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider upgrading to the fixed versions listed in the description once they are released. Monitoring and controlling user inputs that could trigger recursion may help mitigate risk temporarily.