Threats affecting pkg:maven/org.springframework.cloud/spring-cloud-function

CVE-2026-40990 is a medium severity vulnerability in Spring Cloud Function that allows an attacker to cause an out-of-memory (OOM) error by adding an unlimited number of functions to the Function Registry. This results from allocation of resources without limits or throttling. The vulnerability can lead to denial of service through resource exhaustion but does not affect confidentiality or cause data loss. Multiple specific versions of Spring Cloud Function are affected. No official patch or remediation guidance has been confirmed yet.

CVE-2026-40989 is a medium severity vulnerability in Spring Cloud Function involving uncontrolled recursion in the routing layer. This flaw can cause an out-of-memory (OOM) condition, resulting in denial of service. It does not affect confidentiality but impacts availability due to resource exhaustion. The vulnerability affects specific versions of Spring Cloud Function. No official patch or remediation guidance is currently confirmed.