OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
Update org.springframework.cloud:spring-cloud-function-context to 4.3.3; org.springframework.cloud:spring-cloud-function-context to 5.0.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanSpring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry affects org.springframework.cloud:spring-cloud-function-context (maven), org.springframework.cloud:spring-cloud-function-context (maven), org.springframework.cloud:spring-cloud-function-context (maven), org.springframework.cloud:spring-cloud-function-context (maven), org.springframework.cloud:spring-cloud-function-context (maven). Severity is medium. OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
AI coding agents often install or upgrade packages automatically in maven. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package |
|---|
OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
Update org.springframework.cloud:spring-cloud-function-context to 4.3.3; org.springframework.cloud:spring-cloud-function-context to 5.0.2 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanSpring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry affects org.springframework.cloud:spring-cloud-function-context (maven), org.springframework.cloud:spring-cloud-function-context (maven), org.springframework.cloud:spring-cloud-function-context (maven), org.springframework.cloud:spring-cloud-function-context (maven), org.springframework.cloud:spring-cloud-function-context (maven). Severity is medium. OOM error is possible while attempting to add infinite amount of functions to Function Registry. Affected Spring Products and Versions: Spring Cloud Function 3.2.x: versions prior to 3.2.16 Spring Cloud Function 4.1.x: versions prior to 4.1.10 Spring Cloud Function 4.2.x: versions prior to 4.2.6 Spring Cloud Function 4.3.x: versions prior to 4.3.3 Spring Cloud Function 5.0.x: versions prior to 5.0.2 Older, unsupported versions are also affected.
AI coding agents often install or upgrade packages automatically in maven. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package |
|---|
| Affected range |
|---|
| Fixed version |
|---|
| org.springframework.cloud:spring-cloud-function-contextmaven | >=4.3.0,<4.3.3 | 4.3.3 |
|---|---|---|
| org.springframework.cloud:spring-cloud-function-contextmaven | >=5.0.0,<5.0.2 | 5.0.2 |
| org.springframework.cloud:spring-cloud-function-contextmaven | >=3.2.10,<=3.2.15 | Not reported |
| org.springframework.cloud:spring-cloud-function-contextmaven | >=4.1.0,<=4.1.9 | Not reported |
| org.springframework.cloud:spring-cloud-function-contextmaven | >=4.2.0,<=4.2.5 | Not reported |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Affected range |
|---|
| Fixed version |
|---|
| org.springframework.cloud:spring-cloud-function-contextmaven | >=4.3.0,<4.3.3 | 4.3.3 |
|---|---|---|
| org.springframework.cloud:spring-cloud-function-contextmaven | >=5.0.0,<5.0.2 | 5.0.2 |
| org.springframework.cloud:spring-cloud-function-contextmaven | >=3.2.10,<=3.2.15 | Not reported |
| org.springframework.cloud:spring-cloud-function-contextmaven | >=4.1.0,<=4.1.9 | Not reported |
| org.springframework.cloud:spring-cloud-function-contextmaven | >=4.2.0,<=4.2.5 | Not reported |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard