CVE-2026-40990: VMware Spring Cloud Function

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

Affected products

• VMware Spring Cloud Function: from 3.2.0, before 3.2.16 (fixed in 3.2.16); from 4.1.0, before 4.1.10 (fixed in 4.1.10); from 4.2.0, before 4.2.6 (fixed in 4.2.6); from 4.3.0, before 4.3.3 (fixed in 4.3.3); from 5.0.0, before 5.0.2 (fixed in 5.0.2)

Published 2026-06-01. Last modified 2026-07-22.