Spring Cloud Function 3.2.x Release Notes

Security Fixes

• Function message headers can no longer set or override sensitive HTTP response headers, since HeaderUtils now always ignores Set-Cookie, Authorization, Cache-Control, Content-Security-Policy, the proxy-authentication headers, and the CORS Access-Control-* family (low severity, CVE-2026-59298).
• CustomRuntimeEventLoop and CustomRuntimeInitializer no longer log the full AWS Lambda process environment at DEBUG, which now requires TRACE logging together with an explicit SPRING_ENV_DUMP_ALLOW opt-in (low severity, CVE-2026-59300).
• SimpleFunctionRegistry no longer caches an intermediate composition wrapper under a base function name, so mutated output-conversion state can no longer leak into unrelated function lookups (low severity, CVE-2026-59299).

Dependency Upgrades

• Spring Cloud Build (NES) 3.1.9-spring-cloud-build-3.1.14

Security Fixes

• Function registry cache bounded and recursive composition prevented to avoid OOM conditions (CVE-2026-40989).
• Function registry cache size limited to prevent unbounded memory growth from distinct function definitions (CVE-2026-40990).