Spring Cloud Function
Monthly
Spring Cloud Function's Azure integration may inadvertently log sensitive data across three affected release lines (4.2.0-4.2.7, 4.3.0-4.3.4, 5.0.0-5.0.3), resulting in low-impact information disclosure. The vulnerability is constrained by a high-privilege, high-complexity, user-interaction-required exploitation profile (CVSS 3.1), making it a low-priority issue for most organizations. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog; the primary risk is credential or token leakage through application log aggregators accessible to operators or compromised log pipelines.
Spring Cloud Function's AWS adapter component may inadvertently write sensitive data to application logs, creating an information disclosure exposure across a wide range of maintained version branches (3.x through 5.x). The CVSS score of 3.1 reflects genuinely low severity - exploitation requires high privileges and high attack complexity - but the risk in regulated or multi-tenant environments is elevated if log stores are accessible to unauthorized parties or if sensitive data (credentials, payloads, tokens) persists in cloud-native logging services such as AWS CloudWatch. No public exploit code exists and no active exploitation has been identified at time of analysis.
Spring Cloud Function's composition lookup mechanism can be abused by a highly privileged attacker to poison the base function, potentially degrading the integrity and confidentiality of function execution across versions 3.2.16 and earlier through 5.0.3. The vendor-assigned CVSS base score of 3.1 reflects severely constrained exploitation prerequisites - high privilege level, high attack complexity, and required user interaction - substantially limiting realistic exposure. No public exploit code has been identified, and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
HTTP header filtering deficiency in Spring Cloud Function versions 5.0.0-5.0.3, 4.3.0-4.3.4, 4.2.0-4.2.7, and 3.2.16 and earlier allows network-accessible authenticated attackers - under high-complexity conditions and requiring user interaction - to achieve limited confidentiality and integrity impacts via crafted HTTP headers. Reported by VMware, the flaw scores 3.1 (Low) under CVSS 3.1, with multiple compounding prerequisites that substantially restrict real-world exploitability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Spring Cloud Function's ServerlessHttpServletRequest.isSecure() method returns an unchecked result that does not reflect the actual HTTP transport scheme, enabling applications that gate security decisions on this call to behave incorrectly. Affected versions span three active release lines: 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7. No public exploit code exists and the vulnerability is not listed in CISA KEV; the vendor-assigned CVSS of 3.1 (Low) reflects constrained exploitation prerequisites including high privilege and user interaction.
Spring Cloud Function versions across three actively maintained release lines (4.2.x, 4.3.x, and 5.0.x) are affected by a potential arbitrary file read and SSRF vulnerability reported by VMware. The vendor-assigned CVSS 3.1 score of 2.0 reflects severe constraints on exploitability - high privilege requirements (PR:H), required user interaction (UI:R), and high attack complexity (AC:H) together make opportunistic or unauthenticated exploitation implausible. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Denial-of-service in Spring Cloud Function allows a low-privileged actor with physical access and required user interaction to exhaust JVM heap memory by registering an unbounded number of functions into the Function Registry, triggering an Out-of-Memory (OOM) crash. Five actively maintained release lines (3.2.x through 5.0.x) plus all unsupported versions are affected. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; the CVSS score of 5.7 reflects the physical access vector and user interaction dependency that substantially constrain real-world exploitability compared to the High availability impact alone.
Uncontrolled recursion in Spring Cloud Function's routing layer triggers an Out-of-Memory (OOM) condition, resulting in a denial of service across all active release trains (3.2.x through 5.0.x). The vulnerability is rooted in CWE-674 (Uncontrolled Recursion), where the routing layer lacks depth limits or cycle detection, allowing recursive request-handling to exhaust JVM heap space. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS physical attack vector (AV:P) appears inconsistent with a routing-layer vulnerability and warrants verification against the Spring/VMware advisory.
In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Spring Cloud Function's Azure integration may inadvertently log sensitive data across three affected release lines (4.2.0-4.2.7, 4.3.0-4.3.4, 5.0.0-5.0.3), resulting in low-impact information disclosure. The vulnerability is constrained by a high-privilege, high-complexity, user-interaction-required exploitation profile (CVSS 3.1), making it a low-priority issue for most organizations. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog; the primary risk is credential or token leakage through application log aggregators accessible to operators or compromised log pipelines.
Spring Cloud Function's AWS adapter component may inadvertently write sensitive data to application logs, creating an information disclosure exposure across a wide range of maintained version branches (3.x through 5.x). The CVSS score of 3.1 reflects genuinely low severity - exploitation requires high privileges and high attack complexity - but the risk in regulated or multi-tenant environments is elevated if log stores are accessible to unauthorized parties or if sensitive data (credentials, payloads, tokens) persists in cloud-native logging services such as AWS CloudWatch. No public exploit code exists and no active exploitation has been identified at time of analysis.
Spring Cloud Function's composition lookup mechanism can be abused by a highly privileged attacker to poison the base function, potentially degrading the integrity and confidentiality of function execution across versions 3.2.16 and earlier through 5.0.3. The vendor-assigned CVSS base score of 3.1 reflects severely constrained exploitation prerequisites - high privilege level, high attack complexity, and required user interaction - substantially limiting realistic exposure. No public exploit code has been identified, and the vulnerability does not appear in the CISA KEV catalog at time of analysis.
HTTP header filtering deficiency in Spring Cloud Function versions 5.0.0-5.0.3, 4.3.0-4.3.4, 4.2.0-4.2.7, and 3.2.16 and earlier allows network-accessible authenticated attackers - under high-complexity conditions and requiring user interaction - to achieve limited confidentiality and integrity impacts via crafted HTTP headers. Reported by VMware, the flaw scores 3.1 (Low) under CVSS 3.1, with multiple compounding prerequisites that substantially restrict real-world exploitability. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Spring Cloud Function's ServerlessHttpServletRequest.isSecure() method returns an unchecked result that does not reflect the actual HTTP transport scheme, enabling applications that gate security decisions on this call to behave incorrectly. Affected versions span three active release lines: 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7. No public exploit code exists and the vulnerability is not listed in CISA KEV; the vendor-assigned CVSS of 3.1 (Low) reflects constrained exploitation prerequisites including high privilege and user interaction.
Spring Cloud Function versions across three actively maintained release lines (4.2.x, 4.3.x, and 5.0.x) are affected by a potential arbitrary file read and SSRF vulnerability reported by VMware. The vendor-assigned CVSS 3.1 score of 2.0 reflects severe constraints on exploitability - high privilege requirements (PR:H), required user interaction (UI:R), and high attack complexity (AC:H) together make opportunistic or unauthenticated exploitation implausible. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis.
Denial-of-service in Spring Cloud Function allows a low-privileged actor with physical access and required user interaction to exhaust JVM heap memory by registering an unbounded number of functions into the Function Registry, triggering an Out-of-Memory (OOM) crash. Five actively maintained release lines (3.2.x through 5.0.x) plus all unsupported versions are affected. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis; the CVSS score of 5.7 reflects the physical access vector and user interaction dependency that substantially constrain real-world exploitability compared to the High availability impact alone.
Uncontrolled recursion in Spring Cloud Function's routing layer triggers an Out-of-Memory (OOM) condition, resulting in a denial of service across all active release trains (3.2.x through 5.0.x). The vulnerability is rooted in CWE-674 (Uncontrolled Recursion), where the routing layer lacks depth limits or cycle detection, allowing recursive request-handling to exhaust JVM heap space. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS physical attack vector (AV:P) appears inconsistent with a routing-layer vulnerability and warrants verification against the Spring/VMware advisory.
In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.