How many CVEs does spring-cloud spring-cloud-function have?

spring-cloud spring-cloud-function has 4 published CVE records since 2022.

How many spring-cloud spring-cloud-function CVEs are in CISA KEV?

Yes — 1 of spring-cloud spring-cloud-function's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for spring-cloud spring-cloud-function vulnerabilities?

Yes — 1 of spring-cloud spring-cloud-function's CVEs have a known public exploit.

Which versions of spring-cloud spring-cloud-function are affected?

79 distinct spring-cloud spring-cloud-function versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in spring-cloud spring-cloud-function CVEs?

spring-cloud spring-cloud-function's CVEs most often map to these CWE weakness types: CWE-674 (Uncontrolled Recursion), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-94 (Improper Control of Generation of Code ('Code Injection')).

How many critical spring-cloud spring-cloud-function vulnerabilities are there?

spring-cloud spring-cloud-function has 1 critical and 1 high-severity CVEs.

What is the average severity of spring-cloud spring-cloud-function CVEs?

The average CVSS base score across spring-cloud spring-cloud-function's scored CVEs is 7.5.

spring-cloud spring-cloud-function Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every spring-cloud spring-cloud-function version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

1.0.0.M12 CVEs
1.0.0.M22 CVEs
1.0.0.M32 CVEs
1.0.0.M42 CVEs
1.0.0.M52 CVEs
1.0.0.M62 CVEs
1.0.0.RC12 CVEs
1.0.0.RC22 CVEs
1.0.0.RELEASE2 CVEs
2.0.0.M12 CVEs
2.0.0.M22 CVEs
2.0.0.M32 CVEs
2.0.0.M42 CVEs
2.0.0.RC12 CVEs
2.0.0.RC22 CVEs
2.0.0.RC32 CVEs
2.0.0.RELEASE2 CVEs
2.0.1.RELEASE2 CVEs
2.1.0.M12 CVEs
2.1.0.RC12 CVEs
2.1.0.RELEASE2 CVEs
3.0.0.M22 CVEs
3.0.0.M32 CVEs
3.0.0.RC12 CVEs
3.0.0.RC22 CVEs
3.0.0.RELEASE2 CVEs
3.0.1.RELEASE2 CVEs
3.0.2.RELEASE2 CVEs
3.0.3.RELEASE2 CVEs
3.1.02 CVEs
3.1.0-M22 CVEs
3.1.0-M32 CVEs
3.1.0-M42 CVEs
3.1.0-M52 CVEs
3.1.0-RC12 CVEs
3.1.0.M12 CVEs
3.1.12 CVEs
3.1.22 CVEs
3.1.32 CVEs
3.2.02 CVEs
3.2.12 CVEs
3.2.22 CVEs
4.3.02 CVEs
4.3.12 CVEs
4.3.22 CVEs
5.0.02 CVEs
5.0.12 CVEs
3.1.41 CVE
3.1.51 CVE
3.1.61 CVE
3.2.0-M11 CVE
3.2.0-M21 CVE
3.2.0-M31 CVE
3.2.0-RC11 CVE
3.2.31 CVE
3.2.41 CVE

Version ranges

<= 1.10.01 CVE
<= 1.15.01 CVE
<= 1.7.01 CVE
<= 1.8.01 CVE
<= 1.9.01 CVE
<= 12.6.0.0.01 CVE
<= 14.21 CVE
<= 14.51 CVE
<= 20.0.11 CVE
<= 21.0.01 CVE
<= 22.1.01 CVE
<= 22.1.21 CVE
<= 22.1.31 CVE
<= 3.6.1.01 CVE

Fixed in

081ae5189db0f351089cbf11db8d957ad99ef56c2 CVEs
d417ed0d581b113fd6c9112a6b3e5451497bbf4a2 CVEs
698453947b2022e1a3c6ed8b450b57d67656c9d91 CVE

Find a version

4 CVEs

Sort

Unbounded cache for function definitions
CVE-2026-40990
Patch
CWE-770
Medium · CVSS 6.5
EPSS 0.2% (12th pct)2026-06-01
Self Routing guard bypassed via function composition
CVE-2026-40989
Patch
CWE-674
Medium · CVSS 6.5
EPSS 0.2% (12th pct)2026-06-01
High vulnerability · 2022-06-21
CVE-2022-22979
Patch
High · CVSS 7.5
EPSS 1.3% (67th pct)2022-06-21
Critical vulnerability · 2022-04-01
CVE-2022-22963
CISA KEV
Public exploit
Patch
CWE-94
Added to CISA KEV 2022-08-25
Critical · CVSS 9.3
EPSS 99.9% (100th pct)2022-04-01

spring-cloud spring-cloud-function Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Specific versions

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other spring-cloud products

Frequently asked questions

References

Track spring-cloud spring-cloud-function vulnerabilities