CVE-2026-41721

MEDIUM

Spring Data Commons Denial of Service via Data Binding

Title source: cna
STIX 2.1

Description

Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

References (1)

Core 1

Scores

CVSS v3 5.9
EPSS 0.0033
EPSS Percentile 24.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-400
Status published
Products (8)
Spring/Spring Data Commons 2.7.0 - 2.7.20
Spring/Spring Data Commons 3.0.0 - 3.0.16
Spring/Spring Data Commons 3.1.0 - 3.1.15
Spring/Spring Data Commons 3.2.0 - 3.2.16
Spring/Spring Data Commons 3.3.0 - 3.3.17
Spring/Spring Data Commons 3.4.0 - 3.4.15
Spring/Spring Data Commons 3.5.0 - 3.5.12
Spring/Spring Data Commons 4.0.0 - 4.0.6
Published Jun 10, 2026
Tracked Since Jun 10, 2026