CVE-2026-40989: Spring Cloud Function Infinite Recursion OOM Vulnerability

Technical summary

CVE-2026-40989 stems from inadequate recursion depth validation in Spring Cloud Function's request routing logic. When a specially crafted request traverses the routing layer, it can trigger unbounded recursive calls without a termination condition, leading to rapid heap exhaustion and denial-of-service via OOM. The flaw is classified under CWE-674 (Uncontrolled Recursion) and affects multiple version families: 3.2.x (before 3.2.16), 4.1.x (before 4.1.10), 4.2.x (before 4.2.6), 4.3.x (before 4.3.3), and 5.0.x (before 5.0.2). Older unsupported versions remain vulnerable. The CVSS 3.1 score of 5.7 (MEDIUM) reflects the access constraints (physical or privileged local) needed to trigger the condition.

Business impact

Exploitation results in service unavailability rather than data breach or unauthorized access. For organizations running Spring Cloud Function in production—particularly serverless or function-as-a-service deployments—an OOM crash can disrupt workflows, trigger incident response, and incur downtime costs. In multi-tenant or shared-infrastructure scenarios, a compromised function instance could affect neighboring workloads. However, the attack surface is limited to adversaries with local or physical system presence, reducing risk for externally-facing cloud deployments with proper network isolation.

Affected systems

Any Spring Cloud Function deployment in versions 3.2.x through 5.0.x (as enumerated) is potentially affected. Unsupported legacy versions prior to 3.2.x are also vulnerable. Organizations should audit their deployment manifests, container image registries, and dependency lock files to identify active instances. Spring Boot applications that embed Spring Cloud Function, microservices using it for routing, and serverless platforms built on these versions require assessment.

Exploitability

The vulnerability requires either physical access to the affected host or authenticated local access, significantly constraining real-world exploit likelihood in cloud-native environments. Public internet-facing applications are protected by this access barrier unless they have been compromised via other means or are running in untrusted multi-tenant settings. The vulnerability is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no evidence of active weaponization in the wild to date. Nevertheless, the path to denial-of-service is straightforward once access conditions are met, making it a concern for insider threats and lateral-movement scenarios.

Remediation

Upgrade immediately to patched versions: 3.2.16 or later for 3.2.x, 4.1.10 or later for 4.1.x, 4.2.6 or later for 4.2.x, 4.3.3 or later for 4.3.x, and 5.0.2 or later for 5.0.x. Unsupported legacy versions should be migrated to a supported release. Verify patches against official VMware Spring Cloud Function security advisories to confirm version eligibility. Organizations unable to patch immediately should prioritize network segmentation and access controls to limit the attack surface to authenticated, trusted actors only.

Patch guidance

Plan patching by version cohort to minimize disruption. For development and staging environments, apply patches immediately to validate compatibility with your application logic. Production deployments should follow a staged rollout: begin with non-critical functions, monitor for regression, then expand to core services. Always test patches in an environment that mirrors production configuration. Refer to VMware's official Spring Cloud Function release notes for each version to confirm dependency updates or breaking changes. Consider using automated dependency scanning and software composition analysis (SCA) tools to track patch status across your codebase and container supply chain.

Detection guidance

Monitor application logs for unusual OOM exceptions originating from the routing layer or request-handling components. Correlate sudden process terminations with anomalous request patterns or logs showing deep call stacks. Container orchestration platforms (Kubernetes, etc.) should alert on repeated pod evictions due to memory limits or OOMKilled status. Network-based detection is limited due to the local/physical access requirement; focus on endpoint-level monitoring. Implement resource quotas and memory limits on function containers to contain blast radius and trigger alerts before full OOM events occur. Review access logs for authentication attempts or privilege escalation that might precede exploitation.

Why prioritize this

Assign this a medium priority within your patch cycle. While the CVSS score is moderate and the access barrier is high, Spring Cloud Function is widely used in serverless and microservice architectures where availability is critical. Organizations with strict zero-trust policies and strong lateral-movement controls can defer patching slightly, but those with permissive internal networks, shared infrastructure, or hostile-environment assumptions should prioritize rapid remediation. Unsupported version users should escalate this to high priority due to the absence of any security maintenance.

Risk score, explained

The CVSS 3.1 score of 5.7 (MEDIUM) reflects a denial-of-service vector with availability impact (A:H) but no confidentiality or integrity compromise. The physical/local access requirement (AV:P, PR:L) substantially reduces the overall score compared to a remotely exploitable variant. The user-interaction flag (UI:R) adds a further constraint. In practice, the risk to your environment depends on your network architecture, access controls, and operational posture; organizations with strong perimeter and lateral-movement defenses may treat this as lower risk, while those with permissive internal controls should weight it higher.

Frequently asked questions