CVE-2026-41721
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Spring Data Commons has a vulnerability that can lead to a Denial of Service (DoS) when Spring Data Web Support is enabled with a Controller method using @ProjectedPayload. An attacker can send a crafted HTTP request causing excessive memory allocation.
Risk Assessment
A DoS attack can make the application unavailable, affecting business continuity.
Recommendation
Upgrade Spring Data Commons to version 4.0.6, 3.5.12, 3.4.15, 3.3.17, 3.2.16, 3.1.15, 3.0.16, or 2.7.20 depending on your branch.
Other vulnerabilities in Spring Data Commons
See all- CVE-2026-41716High
Vulnerability in Spring Data Commons causes the internal property-lookup cache to accept and permanently store attacker-supplied strings as keys, leading to heap exhaustion through repeated requests.
- CVE-2026-41711Medium
Applications using Spring Data Commons may be vulnerable to a DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions range from 2.7.0 to 4.0.5.
- CVE-2026-41695High
Vulnerability in Spring Data Commons allows denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.
Original NVD description (English source)
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.