High

Spring Cloud Function Framework vulnerable to Denial of Service

Disclosed: 09.07.2024
Updated: 11.10.2026 12:21

In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2, 4.0.x prior to 4.0.8 an application is vulnerable to a DOS attack when attempting to compose functions with non-existing functions.

Specifically, an application is vulnerable when all of the following are true:

User is using Spring Cloud Function Web module

Affected Spring Products and Versions Spring Cloud Function Framework 4.1.0 to 4.1.2 4.0.0 to 4.0.8

References https://spring.io/security/cve-2022-22979 https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation/ History 2020-01-16: Initial vulnerability report published.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	org.springframework.cloud:spring-cloud-function-context	>= 4.0.0, < 4.0.8, >= 4.1.0, < 4.1.2	4.0.8, 4.1.2

References

CVSS score 8.2/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness (CWE): CWE-20
Platform: Java / Kotlin (Maven)
Package: org.springframework.cloud:spring-cloud-function-context
Disclosed: 09.07.2024
Updated: 11.10.2026 12:21

Sources and licenses

OSV / GitHub Advisory Database - GHSA-j4r7-p9fp-w3f3 - CC BY 4.0

Vulnerability history: org.springframework.cloud:spring-cloud-function-context

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 4
First → latest: 04.2022 06.2026
Without a fix: 0
Exploited in attacks: 1

Severity breakdown

Critical 1
High 1
Medium 2

Disclosures per year

2022: 1
2023: 0
2024: 1
2025: 0
2026: 2

01.06.2026

Spring Cloud Function Context has Uncontrolled Recursion

Medium · 5.7 CVE-2026-40989 >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.2, >= 3.2.10, <= 3.2.15, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.5 4.3.3, 5.0.2
01.06.2026

Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

Medium · 5.7 CVE-2026-40990 >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.2, >= 3.2.10, <= 3.2.15, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.5 4.3.3, 5.0.2
09.07.2024

Spring Cloud Function Framework vulnerable to Denial of Service this entry

High · 8.2 CVE-2024-22271 >= 4.0.0, < 4.0.8, >= 4.1.0, < 4.1.2 4.0.8, 4.1.2
03.04.2022

Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

Critical · 9.8 Exploited in attacks CVE-2022-22963 >= 3.2.0, < 3.2.3, < 3.1.7 3.2.3, 3.1.7

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application