CVE-2026-41695
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in Spring Data Commons allows denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.
Risk Assessment
An attacker can cause system resource exhaustion, leading to denial of service (DOS) and application unavailability.
Recommendation
Update Spring Data Commons to version 3.4.15, 3.5.12, or 4.0.6 (depending on the branch). Limit the ability to pass complex property paths.
Other vulnerabilities in Spring Data Commons
See all- CVE-2026-41721Medium
Spring Data Commons has a vulnerability that can lead to a Denial of Service (DoS) when Spring Data Web Support is enabled with a Controller method using @ProjectedPayload. An attacker can send a crafted HTTP request causing excessive memory allocation.
- CVE-2026-41716High
Vulnerability in Spring Data Commons causes the internal property-lookup cache to accept and permanently store attacker-supplied strings as keys, leading to heap exhaustion through repeated requests.
- CVE-2026-41711Medium
Applications using Spring Data Commons may be vulnerable to a DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions range from 2.7.0 to 4.0.5.
Original NVD description (English source)
Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14.