Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41721Spring Data Commons Denial of Service via Data Binding
Medium 5.9
In plain English
A medium-severity uncontrolled resource consumption in Spring Data Commons from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.data:spring-data-commons | 4.0.6 | GHSA-5m4m-73w9-8433 |
| Maven | org.springframework.data:spring-data-commons | 3.5.12 | GHSA-5m4m-73w9-8433 |
| Maven | org.springframework.data:spring-data-commons | no fix listed | GHSA-5m4m-73w9-8433 |
| Maven | org.springframework.data:spring-data-commons | no fix listed | GHSA-5m4m-73w9-8433 |
| Maven | org.springframework.data:spring-data-commons | no fix listed | GHSA-5m4m-73w9-8433 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Data Commons | 4.0.0 – before 4.0.5.13.5.0 – before 3.5.11.13.4.0 – before 3.4.153.3.0 – before 3.3.173.2.0 – before 3.2.163.1.0 – before 3.1.153.0.0 – before 3.0.162.7.0 – before 2.7.20 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H