Critical

Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression

Disclosed: 03.04.2022
Updated: 11.10.2026 12:22

CISA confirms exploitation of this vulnerability in real attacks. Prioritise checking whether your application is affected. CISA KEV · CC0 1.0

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	org.springframework.cloud:spring-cloud-function-context	>= 3.2.0, < 3.2.3, < 3.1.7	3.2.3, 3.1.7

References

CVSS score 9.8/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness (CWE): CWE-917, CWE-94
Platform: Java / Kotlin (Maven)
Package: org.springframework.cloud:spring-cloud-function-context
Disclosed: 03.04.2022
Updated: 11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-6v73-fgf6-w5j7 - CC BY 4.0

Vulnerability history: org.springframework.cloud:spring-cloud-function-context

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 4
First → latest: 04.2022 06.2026
Without a fix: 0
Exploited in attacks: 1

Severity breakdown

Critical 1
High 1
Medium 2

Disclosures per year

2022: 1
2023: 0
2024: 1
2025: 0
2026: 2

01.06.2026

Spring Cloud Function Context has Uncontrolled Recursion

Medium · 5.7 CVE-2026-40989 >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.2, >= 3.2.10, <= 3.2.15, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.5 4.3.3, 5.0.2
01.06.2026

Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry

Medium · 5.7 CVE-2026-40990 >= 4.3.0, < 4.3.3, >= 5.0.0, < 5.0.2, >= 3.2.10, <= 3.2.15, >= 4.1.0, <= 4.1.9, >= 4.2.0, <= 4.2.5 4.3.3, 5.0.2
09.07.2024

Spring Cloud Function Framework vulnerable to Denial of Service

High · 8.2 CVE-2024-22271 >= 4.0.0, < 4.0.8, >= 4.1.0, < 4.1.2 4.0.8, 4.1.2
03.04.2022

Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression this entry

Critical · 9.8 Exploited in attacks CVE-2022-22963 >= 3.2.0, < 3.2.3, < 3.1.7 3.2.3, 3.1.7

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application