This vulnerability (CWE-770) in Spring Cloud Function allows an attacker with limited privileges and requiring user interaction to cause an out-of-memory condition by adding an unlimited number of functions to the Function Registry. Affected versions include Spring Cloud Function 3.2.x prior to 3.2.16, 4.1.x prior to 4.1.10, 4.2.x prior to 4.2.6, 4.3.x prior to 4.3.3, and 5.0.x prior to 5.0.2, as well as older unsupported versions. The CVSS 3.1 base score is 5.7 (medium), with attack vector as physical (AV:P), low attack complexity, low privileges required, user interaction required, scope changed, no confidentiality impact, low integrity impact, and high availability impact.

Successful exploitation can lead to an out-of-memory error causing denial of service by exhausting system resources. There is no direct confidentiality impact, but integrity is slightly affected and availability is highly impacted due to potential service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting the ability to add functions to the Function Registry or monitor resource usage to prevent exhaustion. No vendor advisory or official patch information is currently provided.