The flaw lies in ServerlessHttpServletRequest’s isSecure() implementation, which fails to verify the actual URI scheme. As a result, an HTTP request can be reported as secure, allowing an application that relies on isSecure() to treat an insecure connection as if it were encrypted. This misidentification does not enable direct code execution or data theft, but it undermines security controls that depend on accurate scheme verification and can lead to authentication bypass or unauthorized data exposure. The weakness is classified as CWE-346 (Insecure Direct Object Reference). The CVE description does not provide a specific attack vector, but it is inferred that an attacker could trigger the misreport by sending a request that meets the application’s criteria for a secure connection while remaining unencrypted.

Spring Cloud Function versions 5.0.0 through 5.0.3, 4.3.0 through 4.3.4, and 4.2.0 through 4.2.7 are vulnerable.

The CVSS score of 3.1 indicates low severity, and the EPSS score of less than 1% reflects a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Because the issue merely misreports the scheme, it does not provide a direct remote code execution vector; however, if an environment depends on isSecure() to enforce encryption or authentication, the flaw could be leveraged to bypass those controls and expose data.