-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from improper caching in the Function Catalog component (CWE-770). The SimpleFunctionRegistry's lookup method is responsible for function resolution and caching. Prior to 3.2.6, this implementation likely used an unbounded cache, allowing attackers to create unlimited cached function entries via crafted requests. This matches the advisory's description of a DoS through framework lookup functionality and aligns with the Function Catalog's role in managing function instances. The web module exposure mentioned in VMware's advisory suggests this lookup path is externally triggerable.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework.cloud:spring-cloud-function-parent | maven | < 3.2.6 | 3.2.6 |
Ongoing coverage of React2Shell