Spring Cloud Function 4.2.x Release Notes

Security Fixes

• Function message headers can no longer set or override sensitive HTTP response headers, since HeaderUtils now always ignores Set-Cookie, Authorization, Cache-Control, Content-Security-Policy, the proxy-authentication headers, and the CORS Access-Control-* family (low severity, CVE-2026-59298).
• AzureWebProxyInvoker no longer logs inbound request bodies at INFO or outbound response bodies at DEBUG, emitting both only at TRACE so payload data does not reach function logs at common verbosity (low severity, CVE-2026-59301).
• CustomRuntimeEventLoop and CustomRuntimeInitializer no longer log the full AWS Lambda process environment at DEBUG, which now requires TRACE logging together with an explicit SPRING_ENV_DUMP_ALLOW opt-in (low severity, CVE-2026-59300).
• JsonMessageConverter no longer selects an arbitrary class on the application classpath as its JSON deserialization target based on the type parameter of an incoming message's content-type (low severity, CVE-2026-59291).

Action required. This protection is opt-in. To enable it, add a META-INF/deserializable.types resource to your application (typically src/main/resources/META-INF/deserializable.types) listing the classes your application legitimately deserializes via the type parameter -- one fully-qualified class name per line; comma-separated names on a single line are also accepted. For example:

com.example.OrderEvent
com.example.CustomerEvent

Once the file is present, a message naming a type that is not listed is no longer converted to that type; its payload is returned unchanged.

• ServerlessHttpServletRequest.isSecure() no longer reports every request as insecure and now returns true when the request scheme is https (low severity, CVE-2026-59297).
• SimpleFunctionRegistry no longer caches an intermediate composition wrapper under a base function name, so mutated output-conversion state can no longer leak into unrelated function lookups (low severity, CVE-2026-59299).

Dependency Upgrades

• Spring Cloud Build (NES) 4.2.4-spring-cloud-build-4.2.7

Security Fixes

• Function registry cache bounded and recursive composition prevented to avoid OOM conditions (CVE-2026-40989).
• Function registry cache size limited to prevent unbounded memory growth from distinct function definitions (CVE-2026-40990).