The resulting @CrossOrigin "origins" attribute is not merged. Issue seems to come from RequestMappingHandlerMapping#initCorsConfiguration which does not use AnnotatedElementUtils.findMergedAnnotation(*, CrossOrigin.class);.
Affects: 4.2 GA
#18022 Introduce predefined composed annotations in core Spring
#18020 Use AnnotatedElementUtils instead of AnnotationUtils wherever feasible
#18021 Support @ResponseStatus as a merged composed annotation
#18054 Support @Cache* as merged composed annotations