On behalf of the Spring Cloud team and everyone who has contributed, I am pleased to announce the following releases of Spring Cloud Function and Spring Cloud Config:

Spring Cloud Config

• 5.0.3 (OSS)
• 4.3.3 (OSS)
• 4.2.7 (Enterprise Only)
• 4.1.10 (Enterprise Only)
• 3.1.13 (Enterprise Only)

The above releases address contain fixes for the following CVEs:

• CVE-2026-40982
• CVE-2026-40981
• CVE-2026-41002
• CVE-2026-41004

Spring Cloud Function

• 5.0.2 (OSS)
• 4.3.3 (OSS)
• 4.1.10 (Enterprise Only)
• 4.2.6 (Enterprise Only)
• 3.2.16(Enterprise Only)

The above releases address contain fixes for the following CVEs:

• CVE-2026-40989
• CVE-2026-40990

Please refer to the releases page for more details.

Project Page | GitHub | Issues | Documentation