What is the CVSS score of CVE-2026-40989?

CVE-2026-40989 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40989?

Yes, a patch is available for CVE-2026-40989. Update the affected software to the latest version immediately.

Spring Cloud Function CVE-2026-40989

EUVD-2026-33733 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-06-01 vmware

GHSA-x9c7-5h6g-hq8q

Java Information Disclosure

5.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.7 MEDIUM

AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Analysis Generated

Jun 01, 2026 - 19:35 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

154 maven packages depend on org.springframework.cloud:spring-cloud-function-context (16 direct, 138 indirect)

Ecosystem-wide dependent count for version 4.3.0.

DescriptionCVE.org

Under infinite recursion in the routing layer, request-handling can cause OOM error.

Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

AnalysisAI

Uncontrolled recursion in Spring Cloud Function's routing layer triggers an Out-of-Memory (OOM) condition, resulting in a denial of service across all active release trains (3.2.x through 5.0.x). The vulnerability is rooted in CWE-674 (Uncontrolled Recursion), where the routing layer lacks depth limits or cycle detection, allowing recursive request-handling to exhaust JVM heap space. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS physical attack vector (AV:P) appears inconsistent with a routing-layer vulnerability and warrants verification against the Spring/VMware advisory.

Technical ContextAI

Spring Cloud Function is a Java-based framework (CPE: cpe:2.3:a:spring:spring_cloud_function:*:*:*:*:*:*:*:*) that abstracts function deployment across cloud runtimes including AWS Lambda, Azure Functions, and Apache OpenWhisk. The routing layer dispatches incoming requests to registered functions. CWE-674 (Uncontrolled Recursion) identifies the root cause: the router can enter an unbounded recursive call chain - either due to circular function references, self-referential routing rules, or missing base-case guards - causing the JVM call stack and heap to grow until an OutOfMemoryError is thrown and the process terminates. The CVSS scope is Changed (S:C), indicating the OOM condition can affect resources beyond the vulnerable Spring application component itself, consistent with a JVM-level crash impacting co-hosted workloads. The 'Information Disclosure' tag in the intelligence metadata conflicts with the CVSS C:N (no confidentiality impact); this tag may reflect secondary behavior such as stack traces leaking internal paths before the crash.

RemediationAI

The primary fix is to upgrade Spring Cloud Function to a patched release matching your current branch: 3.2.16, 4.1.10, 4.2.6, 4.3.3, or 5.0.2. Consult the official advisory at https://spring.io/security/cve-2026-40989 for release artifact details. For teams running unsupported versions (e.g., 3.x branches prior to 3.2.x), the HeroDevs advisory at https://www.herodevs.com/vulnerability-directory/cve-2026-40989 may provide extended support options. If an immediate upgrade is not feasible, consider restricting routing-layer input sources to trusted, validated callers only - untrusted or externally-supplied routing inputs represent the primary trigger surface. Enforcing JVM heap limits and enabling OOM crash restarts via orchestration tooling (Kubernetes liveness probes, systemd restart policies) reduces availability impact duration but does not eliminate the vulnerability. Note that restarting on OOM may create a repeated-crash loop if the triggering input is replayed.