Spin buffers entire responses from databases or HTTP servers that can return unbounded data. If a response grows larger than the host’s available memory, Spin may allocate memory equal to the response size, leading to an out‑of‑memory condition. This scenario represents a resource exhaustion vulnerability (CWE‑770) and can trigger a panic or crash (CWE‑774). The large allocations also involve memory usage beyond expected limits (CWE‑789). Consequently, the host process crashes, denying availability to all running serverless functions.

Vulnerable versions include Spin prior to 3.6.1, SpinKube prior to 0.6.2, and containerd‑shim‑spin prior to 0.22.1. These releases may buffer unbounded responses when configured to connect to databases or HTTP servers that can produce very large payloads. The patched releases—Spin 3.6.1, SpinKube 0.6.2, and containerd‑shim‑spin 0.22.1—implement safeguards that prevent the host from allocating excessive memory.

The CVSS score of 6.9 indicates medium severity while the EPSS score of less than 1 % indicates a very low but nonzero probability that this vulnerability will be exploited. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. Based on the description, it is inferred that an attacker would need to control or influence a data source that can produce large responses, then trigger a request that generates a payload larger than the host memory. The attack path involves Spin allocating memory for the entire response, exhausting memory, and causing the host process to crash. Mitigation requires applying the patch or restricting access to trusted, size‑limited servers.