CVE-2026-40990: Spring Cloud Function OOM Denial-of-Service Vulnerability

Technical summary

CVE-2026-40990 is a denial-of-service vulnerability rooted in CWE-770 (Allocation of Resources Without Limits or Throttling). The Function Registry in Spring Cloud Function lacks proper bounds on the number of functions that can be registered, permitting an attacker with local or physical proximity access to inject an unbounded number of function definitions. This exhausts available heap memory, causing the JVM to throw OOM exceptions and crash the application. The vulnerability is context-dependent: it requires some form of user interaction or social engineering to register malicious functions, which limits its exploitability in fully automated attack scenarios.

Business impact

Organizations deploying Spring Cloud Function in microservices architectures face potential service disruption. An attacker who gains local or adjacent-network access and tricks a developer or administrator into registering untrusted functions can crash the Function Registry, interrupting downstream services that depend on it. This is particularly impactful in multi-tenant or hybrid cloud environments where function registration may be exposed via API or management interfaces. Recovery requires manual intervention and restart, introducing unplanned downtime.

Affected systems

Spring Cloud Function versions prior to: 3.2.16, 4.1.10, 4.2.6, 4.3.3, and 5.0.2 are vulnerable. Older, end-of-life versions in the 3.x, 4.x, and 5.0 lines are also affected. Organizations running Spring Cloud Function as part of Spring Cloud ecosystem deployments—particularly in containerized or Kubernetes environments—should audit their current versions immediately.

Exploitability

Exploitation requires local or adjacent network access (physical proximity or same network segment), with a low complexity attack surface once access is obtained. The requirement for user interaction—specifically convincing a developer or operator to register a function definition—raises the barrier to opportunistic exploitation but remains feasible in social engineering scenarios. The attack does not grant unauthorized data access or code execution; it is purely a denial-of-service vector. The CVSS 3.1 score of 5.7 (MEDIUM) reflects this constrained attack surface.

Remediation

Immediate action: upgrade Spring Cloud Function to patched versions (3.2.16, 4.1.10, 4.2.6, 4.3.3, or 5.0.2 and later). For organizations unable to patch immediately, implement network segmentation to restrict who can access the Function Registry API, enforce strict access controls on function registration endpoints, and monitor heap memory usage for anomalous spikes. Consider disabling dynamic function registration in production if not operationally required.

Patch guidance

VMware has released patches in the Spring Cloud Function versions specified above. Verify your current version by checking the spring-cloud-function dependency version in your pom.xml, build.gradle, or via runtime inspection (Spring Boot Actuator endpoints). Test patches in a staging environment before production deployment, as function registration behavior should be validated across your application stack. Refer to the official VMware Spring Cloud Function release notes for version-specific upgrade instructions and any breaking changes.

Detection guidance

Monitor application logs for repeated OOM exceptions originating from Spring Cloud Function components. Implement JVM memory alerting to detect sudden heap pressure or sustained high memory utilization. Track invocations to function registration endpoints (if exposed) and alert on unusually high registration rates from single sources. In containerized environments, watch for pod evictions due to memory limits. Correlate OOM events with user or API access logs to identify malicious registration patterns. Consider deploying distributed tracing to observe function lifecycle events and detect resource anomalies in real time.

Why prioritize this

While this vulnerability is MEDIUM severity with limited exploitability, it poses a direct denial-of-service threat to Spring Cloud Function deployments. Organizations should prioritize patching based on exposure: highest priority for environments where the Function Registry is exposed via untrusted APIs or accessible to a broad internal user base, and lower priority for isolated development instances with strict access controls. The patch availability and straightforward upgrade path make this a low-friction remediation effort.

Risk score, explained

The CVSS 3.1 score of 5.7 reflects a bounded attack vector (local/adjacent, requiring user interaction), no confidentiality impact, limited integrity impact, and high availability impact (OOM crashes the process). The score would be lower if physical or administrative privileges were required; it lands in MEDIUM because the user-interaction condition is somewhat weak in environments with lax function registration policies. In high-security contexts with restrictive access controls, this vulnerability's practical risk is lower than the base score suggests.

Frequently asked questions