Spring Data Commons vulnerabilities
4 known CVE vulnerabilities in Spring Data Commons, translated and rated.
- CVE-2026-41721Medium
Spring Data Commons has a vulnerability that can lead to a Denial of Service (DoS) when Spring Data Web Support is enabled with a Controller method using @ProjectedPayload. An attacker can send a crafted HTTP request causing excessive memory allocation.
- CVE-2026-41716High
Vulnerability in Spring Data Commons causes the internal property-lookup cache to accept and permanently store attacker-supplied strings as keys, leading to heap exhaustion through repeated requests.
- CVE-2026-41711Medium
Applications using Spring Data Commons may be vulnerable to a DoS attack leading to a StackOverflowException when parsing Sort parameters. Affected versions range from 2.7.0 to 4.0.5.
- CVE-2026-41695High
Vulnerability in Spring Data Commons allows denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.