GHSA-x9c7-5h6g-hq8q

Suggest an improvement
Source
https://github.com/advisories/GHSA-x9c7-5h6g-hq8q
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x9c7-5h6g-hq8q/GHSA-x9c7-5h6g-hq8q.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-x9c7-5h6g-hq8q
Aliases
Published
2026-06-01T21:30:42Z
Modified
2026-07-09T13:56:44Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:H CVSS Calculator
Summary
Spring Cloud Function Context has Uncontrolled Recursion
Details

Under infinite recursion in the routing layer, request-handling can cause OOM error.

Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.

Database specific 
{
    "cwe_ids":  [
        "CWE-674"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-09T13:38:38Z",
    "nvd_published_at":  "2026-06-01T19:16:39Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven
org.springframework.cloud:spring-cloud-function-context

Package

Name
org.springframework.cloud:spring-cloud-function-context
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.cloud/spring-cloud-function-context

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.3.0
Fixed
4.3.3

Affected versions

4.*
4.3.0
4.3.1
4.3.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x9c7-5h6g-hq8q/GHSA-x9c7-5h6g-hq8q.json"
org.springframework.cloud:spring-cloud-function-context

Package

Name
org.springframework.cloud:spring-cloud-function-context
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.cloud/spring-cloud-function-context

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.0.0
Fixed
5.0.2

Affected versions

5.*
5.0.0
5.0.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x9c7-5h6g-hq8q/GHSA-x9c7-5h6g-hq8q.json"
org.springframework.cloud:spring-cloud-function-context

Package

Name
org.springframework.cloud:spring-cloud-function-context
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.cloud/spring-cloud-function-context

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.2.10
Last Affected
3.2.15

Affected versions

3.*
3.2.10
3.2.11
3.2.12

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x9c7-5h6g-hq8q/GHSA-x9c7-5h6g-hq8q.json"
org.springframework.cloud:spring-cloud-function-context

Package

Name
org.springframework.cloud:spring-cloud-function-context
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.cloud/spring-cloud-function-context

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.0
Last Affected
4.1.9

Affected versions

4.*
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x9c7-5h6g-hq8q/GHSA-x9c7-5h6g-hq8q.json"
org.springframework.cloud:spring-cloud-function-context

Package

Name
org.springframework.cloud:spring-cloud-function-context
View open source insights on deps.dev
Purl
pkg:maven/org.springframework.cloud/spring-cloud-function-context

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0
Last Affected
4.2.5

Affected versions

4.*
4.2.0
4.2.1
4.2.2
4.2.3
4.2.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x9c7-5h6g-hq8q/GHSA-x9c7-5h6g-hq8q.json"