Spring Data Commons vulnerabilities

2 known vulnerabilities in Spring Data Commons from Spring. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Spring Data Commons: Allocation of Resources Without Limits or Throttling

  CVE-2026-41716Jun 10, 2026Spring

  Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 t

• 7.5 High severity

  Spring Data Commons: Uncontrolled Resource Consumption

  CVE-2026-41695Jun 10, 2026Spring

  Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5