CVE-2026-41716
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in Spring Data Commons causes the internal property-lookup cache to accept and permanently store attacker-supplied strings as keys, leading to heap exhaustion through repeated requests.
Risk Assessment
An attacker can cause heap memory exhaustion, leading to denial of service (DOS) and application unavailability.
Recommendation
Update Spring Data Commons to version 2.7.20, 3.3.17, 3.4.15, 3.5.12, or 4.0.6 (depending on the branch). Limit the ability to pass long strings.
Other vulnerabilities in Spring Data Commons
See all- CVE-2026-41721Medium
Spring Data Commons has a vulnerability that can lead to a Denial of Service (DoS) when Spring Data Web Support is enabled with a Controller method using @ProjectedPayload. An attacker can send a crafted HTTP request causing excessive memory allocation.
- CVE-2026-41711Medium
Applications using Spring Data Commons may be vulnerable to a DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions range from 2.7.0 to 4.0.5.
- CVE-2026-41695High
Vulnerability in Spring Data Commons allows denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.
Original NVD description (English source)
Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.