CVE-2026-41695

HIGH

Denial of Service in Spring Data Commons Property Path Resolution

Title source: cna
STIX 2.1

Description

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14.

References (1)

Core 1

Scores

CVSS v3 7.5
EPSS 0.0036
EPSS Percentile 29.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-400
Status published
Products (9)
broadcom/spring_data_commons 3.4.0 - 3.4.15
org.springframework.data/spring-data-commons 3.4.0 - 3.4.13Maven
org.springframework.data/spring-data-commons 3.5.0 - 3.5.12Maven
org.springframework.data/spring-data-commons 4.0.0 - 4.0.6Maven
Spring/Spring Data Commons 3.4.0 - 3.4.15
Spring/Spring Data Commons 3.5.0 - 3.5.11.1
Spring/Spring Data Commons 3.5.0 - 3.5.12
Spring/Spring Data Commons 4.0.0 - 4.0.5.1
Spring/Spring Data Commons 4.0.0 - 4.0.6
Published Jun 10, 2026
Tracked Since Jun 10, 2026