CVE-2026-41716

HIGH

Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names

Title source: cna

Description

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.

References (1)

Core 1

Core References

https://spring.io/security/cve-2026-41716

Scores

CVSS v3 7.5

EPSS 0.0032

EPSS Percentile 23.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-770

Status published

Products (5)

Spring/Spring Data Commons 2.7.0 - 2.7.20

Spring/Spring Data Commons 3.3.0 - 3.3.17

Spring/Spring Data Commons 3.4.0 - 3.4.15

Spring/Spring Data Commons 3.5.0 - 3.5.12

Spring/Spring Data Commons 4.0.0 - 4.0.6

Published Jun 10, 2026

Tracked Since Jun 10, 2026