Vmware Spring Cloud Function up to 5.0.1 Routing Layer recursion

Summaryinfo

A vulnerability identified as problematic has been detected in Vmware Spring Cloud Function up to 3.2.15/4.1.9/4.2.5/4.3.2/5.0.1. The affected element is an unknown function of the component Routing Layer. This manipulation causes recursion. This vulnerability is tracked as CVE-2026-40989. It is feasible to perform the attack on the physical device. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Vmware Spring Cloud Function up to 3.2.15/4.1.9/4.2.5/4.3.2/5.0.1. It has been declared as problematic. Affected by this vulnerability is some unknown functionality of the component Routing Layer. The manipulation with an unknown input leads to a recursion vulnerability. The CWE definition for the vulnerability is CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. As an impact it is known to affect integrity, and availability. The summary by CVE is:

Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

It is possible to read the advisory at spring.io. This vulnerability is known as CVE-2026-40989 since 04/16/2026. The exploitation appears to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 3.2.16, 4.1.10, 4.2.6, 4.3.3 or 5.0.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Vmware

Name

• Spring Cloud Function

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 3.2.7
• 3.2.8
• 3.2.9
• 3.2.10
• 3.2.11
• 3.2.12
• 3.2.13
• 3.2.14
• 3.2.15
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.1.8
• 4.1.9
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.3.0
• 4.3.1
• 4.3.2
• 5.0.0
• 5.0.1

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion