Resource exhaustion in Spring Cloud Function - CVE-2026-40990
Published: May 11, 2026
Vulnerability identifier: #VU130981
CSH Severity: Low
CVSS v4: 5.2 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40990
CWE-ID: CWE-400
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the function registry when adding function definitions. An attacker with physical access can add an infinite number of functions to cause a denial of service.
User interaction is required.
Affected software
Spring Cloud Function
How to mitigate CVE-2026-40990
Install security update from vendor's website.
Spring Cloud Function - addressed in versions 3.2.16, 4.2.6, 4.3.3, 5.0.2