SC
Product
Spring Cloud Function
On CISA KEVExploited in the wild
11
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 1Medium 5Low 4
Watch
Add Spring Cloud Function to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-22963 In wildKEV | 9.8 | Apr 1 | VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability Affected: through 3.1.6; 3.2.0 through 3.2.2 |
| CVE-2022-22979 | 7.5 | Jun 21 | In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service… Affected: before 3.2.6 |
| CVE-2026-40990 | 6.5 | Jun 1 | Unbounded cache for function definitions Affected: 3.2.0 before 3.2.16; 4.1.0 before 4.1.10; 4.2.0 before 4.2.6; 4.3.0 before 4.3.3; 5.0.0 before 5.0.2 |
| CVE-2026-40989 | 6.5 | Jun 1 | Self Routing guard bypassed via function composition Affected: 3.2.0 before 3.2.16; 4.1.0 before 4.1.10; 4.2.0 before 4.2.6; 4.3.0 before 4.3.3; 5.0.0 before 5.0.2 |
| CVE-2026-59291 | 5.5 | Aug 27 | Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 5.0.0 before 5.0.4 |
| CVE-2026-59302 | 4.9 | Aug 27 | Potential for logging sensitive data in Spring Cloud Stream Affected: 4.2.0 before 4.2.7; 4.3.0 before 4.3.4; 5.0.0 before 5.0.3 |
| CVE-2026-59301 | 4.9 | Aug 27 | Potential for logging sensitive data in Spring Cloud Function Azure Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 5.0.0 before 5.0.4 |
| CVE-2026-59300 | 3.5 | Aug 27 | Potential for logging sensitive data in Spring Cloud Function AWS Affected: 3.2.0 before 3.2.17; 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 5.0.0 before 5.0.4 |
| CVE-2026-59299 | 3.5 | Aug 27 | Composition lookup can potentially poison base function in Spring Cloud Function Affected: 3.2.0 before 3.2.17; 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 5.0.0 before 5.0.4 |
| CVE-2026-59298 | 3.5 | Aug 27 | Potential for improper filtering of HTTP headers in Spring Cloud Function Affected: 3.2.0 before 3.2.17; 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 5.0.0 before 5.0.4 |
| CVE-2026-59297 | 3.5 | Aug 27 | Spring Cloud Function can incorrectly determine if URI is secure Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.5; 5.0.0 before 5.0.4 |
Showing 11