CVE-2026-40989 Overview
CVE-2026-40989 is a denial-of-service vulnerability in Spring Cloud Function. Infinite recursion in the routing layer causes the request-handling logic to exhaust available memory, producing an OutOfMemoryError (OOM) and disrupting application availability. The flaw is tracked under CWE-674: Uncontrolled Recursion.
Affected releases include Spring Cloud Function 3.2.x before 3.2.16, 4.1.x before 4.1.10, 4.2.x before 4.2.6, 4.3.x before 4.3.3, and 5.0.x before 5.0.2. Older, unsupported versions are also affected. Details are published in the Spring Security Advisory CVE-2026-40989.
Critical Impact
Successful exploitation crashes the affected Spring Cloud Function application through memory exhaustion, resulting in service unavailability.
Affected Products
- Spring Cloud Function 3.2.x versions prior to 3.2.16
- Spring Cloud Function 4.1.x versions prior to 4.1.10, 4.2.x prior to 4.2.6, and 4.3.x prior to 4.3.3
- Spring Cloud Function 5.0.x versions prior to 5.0.2, plus older unsupported branches
Discovery Timeline
- 2026-06-01 - CVE-2026-40989 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-40989
Vulnerability Analysis
The defect resides in the Spring Cloud Function routing layer, which dispatches incoming requests to user-defined functions based on header or path metadata. Under specific input conditions, the routing logic re-enters itself without a terminating base case. Each recursive call grows the JVM call stack and allocates additional handler state on the heap.
As recursion continues unbounded, the Java Virtual Machine consumes available heap memory until it raises java.lang.OutOfMemoryError. The application thread, and frequently the entire process, becomes unresponsive. Persistent exploitation forces operators to restart affected instances to restore service.
Root Cause
The root cause is uncontrolled recursion [CWE-674] in the function routing component. The routing resolver lacks a guard that detects when a request triggers a self-referential function lookup. The absence of recursion-depth limits and cycle detection in the dispatch path allows the call chain to expand indefinitely.
Attack Vector
The CVSS vector indicates a physical attack vector with low complexity, low privileges, and required user interaction. An authenticated actor with local access to the deployment must submit a crafted request that triggers the recursive routing condition. The scope is changed because the OOM error impacts components beyond the vulnerable function, including the hosting JVM and any co-located workloads. Integrity impact is low and availability impact is high; confidentiality is not affected.
No public proof-of-concept exploit is listed, and the vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. EPSS data indicates a low near-term exploitation probability.
Detection Methods for CVE-2026-40989
Indicators of Compromise
- Repeated java.lang.OutOfMemoryError: Java heap space entries in Spring Cloud Function application logs.
- Abrupt JVM restarts or container OOMKilled events on workloads hosting Spring Cloud Function.
- Stack traces referencing the function routing or FunctionInvocationWrapper classes with deeply nested frames.
Detection Strategies
- Inventory running Spring Cloud Function versions across build manifests (pom.xml, build.gradle) and deployed artifacts and flag any release below the fixed versions.
- Correlate HTTP request bursts targeting function routing endpoints with subsequent heap growth and OOM events.
- Enable JVM heap dump on OOM (-XX:+HeapDumpOnOutOfMemoryError) and review dumps for recursive routing frames.
Monitoring Recommendations
- Track JVM heap usage, garbage collection frequency, and thread stack depth on Spring Cloud Function workloads.
- Alert on container restart loops and Kubernetes OOMKilled exit reasons for affected pods.
- Capture and retain application logs covering routing exceptions to support post-incident analysis.
How to Mitigate CVE-2026-40989
Immediate Actions Required
- Upgrade Spring Cloud Function to a fixed release: 3.2.16, 4.1.10, 4.2.6, 4.3.3, or 5.0.2.
- Audit deployed services for vulnerable versions using software composition analysis tooling.
- Restrict access to function routing endpoints to trusted, authenticated callers until patches are applied.
Patch Information
VMware/Spring released fixed versions for each supported branch. Update direct and transitive dependencies on spring-cloud-function-context and related modules to a patched version. Refer to the Spring Security Advisory CVE-2026-40989 for full upgrade guidance and release notes.
Workarounds
- Apply input validation at an upstream gateway to reject requests that supply unexpected or self-referential routing headers.
- Set conservative JVM heap limits and enable container-level memory limits so a single workload failure does not impact neighboring services.
- Constrain network exposure of Spring Cloud Function endpoints to internal segments while remediation is in progress.
# Configuration example: enforce upgrade in Maven
mvn versions:set-property -Dproperty=spring-cloud-function.version -DnewVersion=4.3.3
mvn -U clean verify
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
