Vulnerabilities

TI-2026-42434 CVE-2026-59302 · GHSA-xrpv-44g5-7jxr

Sensitive information in log files in VMware Spring Cloud Stream

LOW 22

Potential for logging sensitive data in Spring Cloud Stream.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00232 Published 2026-08-27 No fix listed CWE-532

TI-2026-42433 CVE-2026-59301 · GHSA-mrhq-pfwx-89gm

Sensitive information in log files in VMware Spring Cloud Function

LOW 22

Potential for logging sensitive data in Spring Cloud Function Azure.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00232 Published 2026-08-27 No fix listed CWE-532

TI-2026-42432 CVE-2026-59300 · GHSA-qf3f-pjrj-5m4x

Sensitive information in log files in VMware Spring Cloud Function

LOW 16

Potential for logging sensitive data in Spring Cloud Function AWS.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00211 Published 2026-08-27 No fix listed CWE-532

TI-2026-42431 CVE-2026-59299 · GHSA-r954-5cwm-rfh6

Composition lookup can potentially poison base function in Spring Cloud Function

LOW 16

Composition lookup can potentially poison base function in Spring Cloud Function.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00211 Published 2026-08-27 No fix listed CWE-471

TI-2026-42430 CVE-2026-59298 · GHSA-mwgg-hfwg-mqmx

Improper input validation in VMware Spring Cloud Function

LOW 16

Potential for improper filtering of HTTP headers in Spring Cloud Function.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00225 Published 2026-08-27 No fix listed CWE-20

TI-2026-42429 CVE-2026-59297 · GHSA-x389-8jh6-xrxm

Spring Cloud Function can incorrectly determine if URI is secure

LOW 16

Implementation of isSecure() call of ServerlessHttpServletRequest does not verify the actual scheme.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00134 Published 2026-08-27 No fix listed CWE-346

TI-2026-42423 CVE-2026-59291 · GHSA-6mg8-cpx2-hrff

Server-side request forgery in VMware Spring Cloud Function

LOW 24

Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00245 Published 2026-08-27 No fix listed CWE-918

TI-2026-29641 CVE-2026-40990 · GHSA-x4h3-g2x4-8gqv

Unbounded cache for function definitions

LOW 28

OOM error is possible while attempting to add infinite amount of functions to Function Registry.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00211 Published 2026-06-01 Fixed in 3.2.16, 4.1.10 +3 CWE-770

TI-2026-29640 CVE-2026-40989 · GHSA-x9c7-5h6g-hq8q

Self Routing guard bypassed via function composition

LOW 28

Under infinite recursion in the routing layer, request-handling can cause OOM error.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00211 Published 2026-06-01 Partial fix · 3.2.16, 4.1.10 +3 CWE-674

TI-2022-07155 CVE-2022-22979 · GHSA-q588-3544-8g33

Resource allocation without limits in Spring Cloud Function

LOW 36

In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a denial-of-service condition due to the caching issue in the Funct…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01407 Published 2022-06-21 Fixed in 3.2.6 CWE-770

TI-2022-07140 CVE-2022-22963 · GHSA-6v73-fgf6-w5j7

Code injection in Spring Cloud Function

CRITICAL 100KEV

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in rem…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99938 Published 2022-04-01 Fixed in 3.2.3, 3.1.7 CWE-94

Vulnerabilities

Filters