This vulnerability arises from an unbounded cache that allows an attacker to add an unlimited number of functions to the Spring Cloud Function registry, eventually causing an out‑of‑memory error. The weakness aligns with CWE-770, resulting in a crash of the application and interruption of service availability.

The flaw impacts Spring Cloud Function across multiple major releases: 3.2.x up to 3.2.15, 4.1.x up to 4.1.9, 4.2.x up to 4.2.5, 4.3.x up to 4.3.2, and 5.0.x up to 5.0.1, with older unsupported versions also affected.

The base score of 5.7 on CVSS reflects a moderate severity for Denial of Service. EPSS is not available and the issue is not yet listed in CISA KEV. The attack vector is inferred to be application‑level, requiring the ability to register functions—likely through authenticated API access or misconfigured function registry exposure. Once the unbounded registry is populated, the application will become unresponsive due to memory exhaustion.