What is the CVSS score of CVE-2026-40990?

CVE-2026-40990 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40990?

Yes, a patch is available for CVE-2026-40990. Update the affected software to the latest version immediately.

Spring Cloud Function CVE-2026-40990

EUVD-2026-33734 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-01 vmware

GHSA-x4h3-g2x4-8gqv

Java Denial Of Service

5.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.7 MEDIUM

AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Jun 01, 2026 - 20:02 EUVD

Analysis Generated

Jun 01, 2026 - 19:35 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

154 maven packages depend on org.springframework.cloud:spring-cloud-function-context (16 direct, 138 indirect)

Ecosystem-wide dependent count for version 4.3.0.

DescriptionCVE.org

OOM error is possible while attempting to add infinite amount of functions to Function Registry.

Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

AnalysisAI

Denial-of-service in Spring Cloud Function allows a low-privileged actor with physical access and required user interaction to exhaust JVM heap memory by registering an unbounded number of functions into the Function Registry, triggering an Out-of-Memory (OOM) crash. Five actively maintained release lines (3.2.x through 5.0.x) plus all unsupported versions are affected. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; the CVSS score of 5.7 reflects the physical access vector and user interaction dependency that substantially constrain real-world exploitability compared to the High availability impact alone.

Technical ContextAI

Spring Cloud Function (CPE: cpe:2.3:a:spring:spring_cloud_function:*:*:*:*:*:*:*:*) is a Java framework developed under VMware/Broadcom's Spring portfolio that abstracts business logic as portable functions deployable across serverless runtimes, messaging platforms, and web endpoints. The Function Registry is a core internal component responsible for maintaining named function beans available to the runtime. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the registry imposes no cap on the quantity of functions that can be registered, allowing heap-allocated objects to accumulate without bound. In a JVM environment, uncontrolled heap growth results in an OutOfMemoryError, which can terminate the process or render it unresponsive. The CVSS scope value of Changed (S:C) indicates the OOM condition can propagate beyond the vulnerable component to affect the host JVM and any co-hosted services sharing the same process or memory space.

RemediationAI

The primary remediation is upgrading Spring Cloud Function to a patched release: 3.2.16 for the 3.2.x line, 4.1.10 for 4.1.x, 4.2.6 for 4.2.x, 4.3.3 for 4.3.x, or 5.0.2 for 5.0.x, as documented in the Spring Security Advisory at https://spring.io/security/cve-2026-40990. Users on older, unsupported versions should migrate to a supported and patched release; HeroDevs may offer commercial extended support guidance at https://www.herodevs.com/vulnerability-directory/cve-2026-40990. Where immediate patching is not feasible, restrict access to any interface that permits dynamic function registration to only explicitly authorized and trusted principals, reducing the likelihood a low-privileged user can trigger unbounded registration. Configuring explicit JVM heap limits (e.g., -Xmx) and deploying the application in a containerized environment with memory cgroup limits can bound the blast radius of an OOM event and prevent host-level impact, though this trades available performance headroom and may introduce premature GC pressure under normal load. Monitoring for anomalous spikes in registered function counts or heap utilization can serve as a detection control.