cbcvebase.

Vmware Spring Cloud Function vulnerabilities

11 known vulnerabilities affecting vmware/spring_cloud_function.

Total CVEs
11
CISA KEV
1
actively exploited
Public exploits
1
Exploited in wild
1
Severity breakdown
CRITICAL1HIGH1MEDIUM5LOW4

Vulnerabilities

Page 1 of 1
CVE-2022-22963P1CRITICALCVSS 9.8KEVPoC≤ 3.1.6≥ 3.2.0, ≤ 3.2.2+1 more2022-04-01
CVE-2022-22963 [CRITICAL] CWE-94 CVE-2022-22963: In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing fu In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
nvd
CVE-2022-22979P3HIGHCVSS 7.5fixed in 3.2.6vSpring Cloud Function (prior to 3.2.6)2022-06-21
CVE-2022-22979 [HIGH] CWE-770 CVE-2022-22979: In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts w In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Function Catalog component of the framework.
nvd
CVE-2026-40990P3MEDIUMCVSS 6.5≥ 3.2.0, < 3.2.16≥ 4.1.0, < 4.1.10+3 more2026-06-01
CVE-2026-40990 [MEDIUM] CWE-770 CVE-2026-40990: OOM error is possible while attempting to add infinite amount of functions to Function Registry. Af OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 S
nvd
CVE-2026-40989P3MEDIUMCVSS 6.5≥ 3.2.0, < 3.2.16≥ 4.1.0, < 4.1.10+3 more2026-06-01
CVE-2026-40989 [MEDIUM] CWE-674 CVE-2026-40989: Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Sprin Under infinite recursion in the routing layer, request-handling can cause OOM error. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud
nvd
CVE-2026-59291P4MEDIUMCVSS 5.5≥ 4.2.0, < 4.2.8≥ 4.3.0, < 4.3.5+1 more2026-08-27
CVE-2026-59291 [MEDIUM] CWE-918 CVE-2026-59291: Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7
nvd
CVE-2026-59301P4MEDIUMCVSS 4.9≥ 4.2.0, < 4.2.8≥ 4.3.0, < 4.3.5+1 more2026-08-27
CVE-2026-59301 [MEDIUM] CWE-532 CVE-2026-59301: Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5 Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7
nvd
CVE-2026-59302P4MEDIUMCVSS 4.9≥ 4.2.0, < 4.2.7≥ 4.3.0, < 4.3.4+1 more2026-08-27
CVE-2026-59302 [MEDIUM] CWE-532 CVE-2026-59302: Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Sprin Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6
nvd
CVE-2026-59300P4LOWCVSS 3.5≥ 3.2.0, < 3.2.17≥ 4.2.0, < 4.2.8+2 more2026-08-27
CVE-2026-59300 [LOW] CWE-532 CVE-2026-59300: Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0 Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier
nvd
CVE-2026-59299P4LOWCVSS 3.5≥ 3.2.0, < 3.2.17≥ 4.2.0, < 4.2.8+2 more2026-08-27
CVE-2026-59299 [LOW] CWE-471 CVE-2026-59299: Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Funct Composition lookup can potentially poison base function in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier
nvd
CVE-2026-59298P4LOWCVSS 3.5≥ 3.2.0, < 3.2.17≥ 4.2.0, < 4.2.8+2 more2026-08-27
CVE-2026-59298 [LOW] CWE-20 CVE-2026-59298: Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0 Potential for improper filtering of HTTP headers in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier
nvd
CVE-2026-59297P4LOWCVSS 3.5≥ 4.2.0, < 4.2.8≥ 4.3.0, < 4.3.5+1 more2026-08-27
CVE-2026-59297 [LOW] CWE-346 CVE-2026-59297: Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7
nvd
Vmware Spring Cloud Function vulnerabilities | cvebase