HeroDevs
Visit NES for Spring Home Page

Spring Cloud Function 3.1.x Release Notes

2 versions

Comprehensive release notes and changelog for Spring Cloud Function 3.1.x, including security patches, bug fixes, and feature updates across all supported versions.

May 8, 2026
Latest: 3.1.9
9 Patched Vulnerabilities
VEX Statements

May 2026

3.1.9

Released May 8, 2026
CVE-2026-40989
CVE-2026-40990
Full Version: 
3.1.7-spring-cloud-function-3.1.9

Bug Fixes

  • Function registry cache bounded and recursive composition prevented to avoid OOM conditions (CVE-2026-40989).
  • Function registry cache size limited to prevent unbounded memory growth from distinct function definitions (CVE-2026-40990).

March 2026

3.1.8

Released Mar 11, 2026
CVE-2022-22979
Full Version: 
3.1.7-spring-cloud-function-3.1.8

Bug Fixes

  • This release patches the following:
    • Denial of service via caching issue in Function Catalog when interacting with lookup functionality (CVE-2022-22979).

Notes

  • This release originates from the open‑source Spring Cloud Function repository forked by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Spring Cloud Function 3.1.7.

Dependency Upgrades

  • Spring Cloud Build (NES) 3.0.5-spring-cloud-build-3.0.6

Stay in the loop

~/herodevs-spring-framework-support

Open Source Support

When official support ends, we're just getting started.