CVE-2024-22271: 
Spring Cloud vulnerability analysis and mitigation

In Spring Cloud Function framework, versions 4.1.x prior to 4.1.2 and 4.0.x prior to 4.0.8, a vulnerability has been identified that makes applications susceptible to Denial of Service (DOS) attacks when attempting to compose functions with non-existing functions. This vulnerability specifically affects users of the Spring Cloud Function Web module (Spring Security).

The vulnerability is classified as a medium severity issue and has been assigned CVE-2024-22271. The vulnerability stems from improper input validation (CWE-20) when attempting to compose functions with non-existing functions in the Spring Cloud Function Web module. The issue affects Spring Cloud Function Framework versions 4.1.0 to 4.1.2 and 4.0.0 to 4.0.8 (NVD).

When exploited, this vulnerability can result in a Denial of Service (DOS) condition for applications using the Spring Cloud Function Web module. The impact is specifically limited to scenarios where applications attempt to compose functions with non-existing functions (ASEC).

The vulnerability requires the application to be using the Spring Cloud Function Web module and attempting to compose functions with non-existing functions. No authentication is required to exploit this vulnerability, making it potentially accessible to remote attackers (Spring Security).

Users of affected versions are advised to upgrade to the fixed versions: 4.1.x users should upgrade to version 4.1.2, and 4.0.x users should upgrade to version 4.0.8. No additional mitigation steps are necessary beyond the version upgrade (Spring Security).

The vulnerability was identified and responsibly reported by security researcher devme4f from VNPT-VCI. The Spring security team has acknowledged the issue and provided fixes in their latest releases (Spring Security).