Actively exploited in the wild
VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
VMware Tanzu - Spring Cloud · Listed in the CISA KEV since 2022-08-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-22963
CriticalCVSS 9.8KEVSummary
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Risk Assessment
An attacker can remotely execute arbitrary code and access local system resources, potentially leading to full server compromise. The vulnerability is particularly dangerous as it may not require authentication in configurations with routing enabled.
Recommendation
Upgrade Spring Cloud Function to version 3.1.7, 3.2.3 or later. If upgrading is not possible, disable the routing functionality or restrict access to the endpoints.
Other vulnerabilities in Spring Cloud Function
See all- CVE-2026-59301Low
In Spring Cloud Function Azure, there is a potential for logging sensitive data, which may lead to leakage of confidential information into logs.
- CVE-2026-59300Low
In Spring Cloud Function AWS, there is a potential for logging sensitive data, which may lead to leakage of confidential information into logs.
- CVE-2026-59299Low
In Spring Cloud Function, composition lookup can potentially poison the base function, which may lead to unauthorized code execution or manipulation of function behavior.
- CVE-2026-59298Low
In Spring Cloud Function, there is a potential for improper filtering of HTTP headers, which may lead to header injection or other header-related attacks.
- CVE-2026-59297Low
The implementation of isSecure() in ServerlessHttpServletRequest does not verify the actual scheme, which may lead to incorrect determination of connection security.
- CVE-2026-59291Low
Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Affects versions 5.0.0-5.0.3, 4.3.0-4.3.4, and 4.2.0-4.2.7.
- CVE-2026-40990Medium
Vulnerability in Spring Cloud Function allows an OOM (Out of Memory) error by attempting to add an infinite number of functions to the Function Registry. It affects multiple versions of the library.
- CVE-2026-40989Medium
Vulnerability in Spring Cloud Function allows an OOM (Out of Memory) error through infinite recursion in the routing layer during request handling. It affects multiple versions of the library.
Original NVD description (English source)
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.