CVE-2026-41711
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Applications using Spring Data Commons may be vulnerable to a DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions range from 2.7.0 to 4.0.5.
Risk Assessment
An attacker can crash the application via stack overflow, leading to denial of service.
Recommendation
Update Spring Data Commons to a patched version (e.g., 4.0.6 or later, depending on the branch).
Other vulnerabilities in Spring Data Commons
See all- CVE-2026-41721Medium
Spring Data Commons has a vulnerability that can lead to a Denial of Service (DoS) when Spring Data Web Support is enabled with a Controller method using @ProjectedPayload. An attacker can send a crafted HTTP request causing excessive memory allocation.
- CVE-2026-41716High
Vulnerability in Spring Data Commons causes the internal property-lookup cache to accept and permanently store attacker-supplied strings as keys, leading to heap exhaustion through repeated requests.
- CVE-2026-41695High
Vulnerability in Spring Data Commons allows denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.
Original NVD description (English source)
Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.