CVE-2026-41721
Spring Data Commons Denial of Service via Data Binding
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory.
Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Spring Data Commons Denial of Service via Data Binding
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory.
Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
- Record
CVE-2026-41721- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-35902
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory.
Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
- Record
EUVD-2026-35902- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5m4m-73w9-8433
Spring Data Commons: Denial of Service via excessive memory allocation in projection binding
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory.
Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
- Record
GHSA-5m4m-73w9-8433- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory.
Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
- Record
CVE-2026-41721- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Spring Data Commons Denial of Service via Data Binding
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory.
Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
- Record
CVE-2026-41721- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-5m4m-73w9-8433
Spring Data Commons: Denial of Service via excessive memory allocation in projection binding
Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction with a Controller method using @ProjectedPayload, when an attacker sends a specially crafted HTTP request that causes the application to allocate lots of memory.
Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
- Record
GHSA-5m4m-73w9-8433- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Show 15 moreShow less
OSVCLSA-2026-1781484835 No score
TuxCare security update for org.springframework.data:spring-data-ldap (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 2 CVEs. Fixed in 2.7.18-tuxcare.3.
- Record
CLSA-2026-1781484835- Updated
- 2026-11-02
OSVCLSA-2026-1781830582 No score
TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.7.18-tuxcare.3.
- Record
CLSA-2026-1781830582- Updated
- 2026-11-02
OSVCLSA-2026-1782089808 No score
TuxCare security update for org.springframework.data:spring-data-keyvalue (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 2 CVEs. Fixed in 2.7.18-tuxcare.3.
- Record
CLSA-2026-1782089808- Updated
- 2026-11-02
OSVCLSA-2026-1782089825 No score
TuxCare security update for org.springframework.data:spring-data-jpa (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-jpa to address 2 CVEs. Fixed in 2.7.18-tuxcare.3.
- Record
CLSA-2026-1782089825- Updated
- 2026-11-02
OSVCLSA-2026-1782089830 No score
TuxCare security update for org.springframework.data:spring-data-redis (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-redis to address 2 CVEs. Fixed in 2.7.18-tuxcare.3.
- Record
CLSA-2026-1782089830- Updated
- 2026-11-02
OSVCLSA-2026-1787403789 No score
TuxCare security update for org.springframework.data:spring-data-commons (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 3 CVEs. Fixed in 3.3.13-tuxcare.3.
- Record
CLSA-2026-1787403789- Updated
- 2026-11-02
OSVCLSA-2026-1788196484 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.
- Record
CLSA-2026-1788196484- Updated
- 2026-11-02
OSVCLSA-2026-1788196519 No score
TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.
- Record
CLSA-2026-1788196519- Updated
- 2026-11-02
OSVCLSA-2026-1788196634 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.
- Record
CLSA-2026-1788196634- Updated
- 2026-11-02
OSVCLSA-2026-1788200476 No score
TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.
- Record
CLSA-2026-1788200476- Updated
- 2026-11-02
OSVCLSA-2026-1788203900 No score
TuxCare security update for org.springframework.data:spring-data-redis (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-redis to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.
- Record
CLSA-2026-1788203900- Updated
- 2026-11-02
OSVCLSA-2026-1789576613 No score
TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 3.3.12-tuxcare.1.
- Record
CLSA-2026-1789576613- Updated
- 2026-11-02
OSVCLSA-2026-1789999145 No score
TuxCare security update for org.springframework.data:spring-data-commons (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 3 CVEs. Fixed in 3.2.12-tuxcare.1.
- Record
CLSA-2026-1789999145- Updated
- 2026-11-02
OSVCLSA-2026-1790666525 No score
TuxCare security update for org.springframework.data:spring-data-commons (3 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 3 CVEs. Fixed in 3.2.11-tuxcare.1.
- Record
CLSA-2026-1790666525- Updated
- 2026-11-02
OSVCLSA-2026-1791974541 No score
TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.4.13-tuxcare.2.
- Record
CLSA-2026-1791974541- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-commonsMaven |
4.0.0 to 4.0.5 | 4.0.6 |
org.springframework.data:spring-data-commonsMaven |
3.5.0 to 3.5.11 | 3.5.12 |
org.springframework.data:spring-data-commonsMaven |
3.4.0 to 3.4.14 | None known |
org.springframework.data:spring-data-commonsMaven |
3.0.0 to 3.3.16 | None known |
org.springframework.data:spring-data-commonsMaven |
through 2.7.19 | None known |
org.springframework.data:spring-data-commonsTuxCare:Maven From an advisory covering 2 CVEs |
2.7.18 up to 2.7.18-tuxcare.3, plus listed versions 2.7.18-tuxcare.22.7.18.tuxcare2.7.18.tuxcare.1 |
2.7.18-tuxcare.3 |
org.springframework.data:spring-data-commonsTuxCare:Maven From an advisory covering 3 CVEs |
3.3.13 up to 3.3.13-tuxcare.3, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.2 |
3.3.13-tuxcare.3 |
org.springframework.data:spring-data-commonsTuxCare:Maven From an advisory covering 2 CVEs |
3.3.12 up to 3.3.12-tuxcare.1 | 3.3.12-tuxcare.1 |
org.springframework.data:spring-data-commonsTuxCare:Maven From an advisory covering 3 CVEs |
3.2.12 up to 3.2.12-tuxcare.1 | 3.2.12-tuxcare.1 |
org.springframework.data:spring-data-commonsTuxCare:Maven From an advisory covering 3 CVEs |
3.2.11 up to 3.2.11-tuxcare.1 | 3.2.11-tuxcare.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.data:spring-data-commonsTuxCare:Maven |
3.4.13 up to 3.4.13-tuxcare.2, plus listed versions 3.4.13-tuxcare.1 |
3.4.13-tuxcare.2 |
org.springframework.data:spring-data-commonsMaven |
4.0.0 up to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 |
4.0.6 |
org.springframework.data:spring-data-commonsMaven |
3.5.0 up to 3.5.12, plus listed versions 3.5.13.5.103.5.113.5.23.5.3 Show 6 moreShow less3.5.43.5.53.5.63.5.73.5.83.5.9 |
3.5.12 |
org.springframework.data:spring-data-commonsMaven |
3.4.0 to 3.4.14, plus listed versions 3.4.13.4.103.4.113.4.123.4.13 Show 8 moreShow less3.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.9 |
None known |
org.springframework.data:spring-data-commonsMaven |
3.0.0 to 3.3.16, plus listed versions 3.0.13.0.103.0.113.0.123.0.2 Show 45 moreShow less3.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.13.3.103.3.113.3.123.3.133.3.23.3.33.3.43.3.53.3.63.3.7 |
None known |
org.springframework.data:spring-data-commonsMaven |
through 2.7.19, plus listed versions 1.10.0.RELEASE1.10.1.RELEASE1.10.2.RELEASE1.11.0.RELEASE1.11.1.RELEASE Show 45 moreShow less1.11.2.RELEASE1.11.4.RELEASE1.11.5.RELEASE1.11.6.RELEASE1.12.0.RELEASE1.12.1.RELEASE1.12.10.RELEASE1.12.11.RELEASE1.12.2.RELEASE1.12.3.RELEASE1.12.4.RELEASE1.12.5.RELEASE1.12.6.RELEASE1.12.7.RELEASE1.12.8.RELEASE1.12.9.RELEASE1.13.0.RELEASE1.13.1.RELEASE1.13.10.RELEASE1.13.11.RELEASE1.13.12.RELEASE1.13.13.RELEASE1.13.14.RELEASE1.13.15.RELEASE1.13.16.RELEASE1.13.17.RELEASE1.13.18.RELEASE1.13.2.RELEASE1.13.20.RELEASE1.13.21.RELEASE1.13.22.RELEASE1.13.23.RELEASE1.13.3.RELEASE1.13.4.RELEASE1.13.5.RELEASE1.13.6.RELEASE1.13.7.RELEASE1.13.8.RELEASE1.13.9.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.2.RELEASE1.5.3.RELEASE1.6.0.RELEASE1.6.1.RELEASE |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41721 is a medium vulnerability (CVSS 5.9) in Broadcom Spring Data Commons, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in org.springframework.data:spring-data-commons 4.0.6.
References
spring.io/security/cve-2026-41721
nvd.nist.gov/vuln/detail/CVE-2026-41721
github.com/spring-projects/spring-data-commons/releases/tag/3.5.12
Left out here: 141 versions. The JSON record has them.