AIKIDO-2026-10804

spring-cloud-function-core is vulnerable to Denial of Service (DoS)

Denial of Service (DoS)CVE-2026-40989 Published May 13, 2026

Medium Risk

This Affects:

spring-cloud-function-core

0.0.1 - 3.1.15

Fixed in 3.1.16

4.0.0 - 4.1.9

Fixed in 4.1.10

4.2.0 - 4.2.5

Fixed in 4.2.6

4.3.0 - 4.3.2

Fixed in 4.3.3

5.0.0 - 5.0.1

Fixed in 5.0.2

Are you affected? Scan for Free

TL;DR

A flaw in the self-routing mechanism allows function composition to bypass recursion guards, causing infinite recursion in the routing layer. Exploitation may result in excessive memory consumption and lead to an out-of-memory (OOM) denial of service condition.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

spring-cloud-function-core is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 3.1.15, 4.0.0 - 4.1.9, 4.2.0 - 4.2.5, 4.3.0 - 4.3.2 and 5.0.0 - 5.0.1.