CVE-2026-40990: Spring Cloud Function DoS Vulnerability

CVE-2026-40990 Overview

CVE-2026-40990 affects Spring Cloud Function, where an attacker can trigger an Out-of-Memory (OOM) condition by repeatedly adding functions to the Function Registry. The flaw is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. Exploitation exhausts JVM heap memory and disrupts application availability.

The issue impacts multiple supported branches of Spring Cloud Function, including the 3.2.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x release lines. Older, unsupported versions are also affected. The Spring team has published fixed releases addressing the unbounded registration logic.

Critical Impact
An authenticated local actor can exhaust application memory through unbounded Function Registry additions, causing a denial-of-service condition with high availability impact.

Affected Products

Spring Cloud Function 3.2.x prior to 3.2.16
Spring Cloud Function 4.1.x prior to 4.1.10, 4.2.x prior to 4.2.6, and 4.3.x prior to 4.3.3
Spring Cloud Function 5.0.x prior to 5.0.2, plus older unsupported releases

Discovery Timeline

2026-06-01 - CVE-2026-40990 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-40990

Vulnerability Analysis

Spring Cloud Function exposes a Function Registry that stores function definitions used at runtime to route and invoke serverless-style handlers. The registry accepts new function registrations without enforcing an upper bound on entry count or cumulative memory footprint. An actor with the ability to register functions can submit an unbounded sequence of additions until the JVM heap is exhausted.

The resulting OutOfMemoryError terminates request processing threads and degrades or crashes the host application. Because the registry is a long-lived component, garbage collection cannot reclaim the retained references. The impact is limited to availability, with no direct confidentiality compromise and only minor integrity effects on registry state.

Root Cause

The root cause is missing throttling and quota enforcement on the function registration path. The registry treats each registration as valid input without tracking aggregate consumption. This matches the [CWE-770] pattern, where a resource-allocating API lacks limits proportional to available system capacity.

Attack Vector

Exploitation requires local access with low privileges and user interaction, consistent with the published attack profile. An attacker leverages an interface that calls into the Function Registry, such as a local management endpoint or an embedded scripting path. Repeated registration calls inflate heap usage until the application becomes unresponsive. Refer to the Spring Security Advisory CVE-2026-40990 for vendor technical details.

Detection Methods for CVE-2026-40990

Indicators of Compromise

Repeated OutOfMemoryError entries in application logs originating from Spring Cloud Function components
Abnormal growth in heap usage correlated with calls into FunctionRegistry registration APIs
Application restarts or container OOMKilled events on services hosting Spring Cloud Function workloads

Detection Strategies

Instrument the application with JVM metrics and alert on sustained heap occupancy above operational baselines
Audit access logs for high-frequency invocations of function registration endpoints from a single source
Correlate process termination events with preceding bursts of registry-related API calls

Monitoring Recommendations

Track JVM HeapMemoryUsage and gc.pause metrics through Micrometer or an equivalent telemetry stack
Enable audit logging for any administrative interface that wraps the Function Registry
Forward application and container runtime logs to a centralized analytics platform for correlation

How to Mitigate CVE-2026-40990

Immediate Actions Required

Upgrade Spring Cloud Function to 3.2.16, 4.1.10, 4.2.6, 4.3.3, or 5.0.2 depending on the active branch
Restrict access to any endpoint or component that performs function registration to trusted administrators only
Set explicit JVM heap limits and container memory caps to bound impact during exploitation attempts

Patch Information

The Spring team has released fixed versions across all supported branches. Consult the Spring Security Advisory CVE-2026-40990 for the authoritative fix matrix and upgrade guidance. Older, unsupported releases will not receive patches and should be migrated to a maintained branch.

Workarounds

Place authentication and authorization controls in front of any interface that reaches the Function Registry
Apply rate limiting on function registration calls at the API gateway or reverse proxy layer
Reduce the JVM heap ceiling on affected services so that OOM events fail fast and trigger orchestrated restarts

bash

# Example Maven dependency upgrade for the 4.3.x branch
mvn versions:set-property -Dproperty=spring-cloud-function.version -DnewVersion=4.3.3
mvn clean package