7.5
High
CVE-2026-41695 Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when…
Description
Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Data Commons 4.0 | 4.0.0 → < 4.0.5.1 | 4.0.5.1 |
| Spring Data Commons 3.5 | 3.5.0 → < 3.5.11.1 | 3.5.11.1 |
| Spring Data Commons 3.4 | 3.4.0 → < 3.4.15 | 3.4.15 |
Other CVEs of Spring Data Commons
The 4 CVEs of Spring Data Commons →
CVE-2026-41721
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web…
5.9
Medium
CVE-2026-41716
Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys,…
7.5
High
CVE-2026-41711
Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a…
5.9
Medium