CVE-2026-41711

Potential Denial of Service through crafted Sort Parameters

5.9 MediumFix available

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.30%Up 0.3 points since Jun 10, 2026

What each source reports

CVE List Score used 5.9

Potential Denial of Service through crafted Sort Parameters

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

Record: CVE-2026-41711
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2026-35897 5.9

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

Record: EUVD-2026-35897
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5vpf-xvv7-c8vh 5.9

Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

Record: GHSA-5vpf-xvv7-c8vh
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

NVD 5.9

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

Record: CVE-2026-41711
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV 5.9

Potential Denial of Service through crafted Sort Parameters

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

Record: CVE-2026-41711
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVGHSA-5vpf-xvv7-c8vh 5.9

Spring Data Commons: StackOverflowException when parsing Sort parameters (DoS)

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsing Sort parameters.

Record: GHSA-5vpf-xvv7-c8vh
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

Show 33 moreShow less

OSVCLSA-2026-1781484835 No score

TuxCare security update for org.springframework.data:spring-data-ldap (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 2 CVEs. Fixed in 2.7.18-tuxcare.3.

Record: CLSA-2026-1781484835
Updated: 2026-11-02

OSVCLSA-2026-1781830582 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.7.18-tuxcare.3.

Record: CLSA-2026-1781830582
Updated: 2026-11-02

OSVCLSA-2026-1782089808 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 2 CVEs. Fixed in 2.7.18-tuxcare.3.

Record: CLSA-2026-1782089808
Updated: 2026-11-02

OSVCLSA-2026-1782089825 No score

TuxCare security update for org.springframework.data:spring-data-jpa (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-jpa to address 2 CVEs. Fixed in 2.7.18-tuxcare.3.

Record: CLSA-2026-1782089825
Updated: 2026-11-02

OSVCLSA-2026-1782089830 No score

TuxCare security update for org.springframework.data:spring-data-redis (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-redis to address 2 CVEs. Fixed in 2.7.18-tuxcare.3.

Record: CLSA-2026-1782089830
Updated: 2026-11-02

OSVCLSA-2026-1787403789 No score

TuxCare security update for org.springframework.data:spring-data-commons (3 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 3 CVEs. Fixed in 3.3.13-tuxcare.3.

Record: CLSA-2026-1787403789
Updated: 2026-11-02

OSVCLSA-2026-1788196484 No score

TuxCare security update for org.springframework.data (4 CVEs)

TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.

Record: CLSA-2026-1788196484
Updated: 2026-11-02

OSVCLSA-2026-1788196519 No score

TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.

Record: CLSA-2026-1788196519
Updated: 2026-11-02

OSVCLSA-2026-1788196634 No score

TuxCare security update for org.springframework.data (4 CVEs)

TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.

Record: CLSA-2026-1788196634
Updated: 2026-11-02

OSVCLSA-2026-1788200476 No score

TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.

Record: CLSA-2026-1788200476
Updated: 2026-11-02

OSVCLSA-2026-1788203900 No score

TuxCare security update for org.springframework.data:spring-data-redis (4 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-redis to address 4 CVEs. Fixed in 3.3.13-tuxcare.3.

Record: CLSA-2026-1788203900
Updated: 2026-11-02

OSVCLSA-2026-1789576613 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 3.3.12-tuxcare.1.

Record: CLSA-2026-1789576613
Updated: 2026-11-02

OSVCLSA-2026-1789995986 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 3.4.13-tuxcare.1.

Record: CLSA-2026-1789995986
Updated: 2026-11-02

OSVCLSA-2026-1789999145 No score

TuxCare security update for org.springframework.data:spring-data-commons (3 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 3 CVEs. Fixed in 3.2.12-tuxcare.1.

Record: CLSA-2026-1789999145
Updated: 2026-11-02

OSVCLSA-2026-1789999868 No score

TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.1.8-tuxcare.1.

Record: CLSA-2026-1789999868
Updated: 2026-11-02

OSVCLSA-2026-1790601895 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.4.8-tuxcare.1.

Record: CLSA-2026-1790601895
Updated: 2026-11-02

OSVCLSA-2026-1790612737 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 3.4.12-tuxcare.1.

Record: CLSA-2026-1790612737
Updated: 2026-11-02

OSVCLSA-2026-1790623749 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 3.2.3-tuxcare.1.

Record: CLSA-2026-1790623749
Updated: 2026-11-02

OSVCLSA-2026-1790666472 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.7.14-tuxcare.1.

Record: CLSA-2026-1790666472
Updated: 2026-11-02

OSVCLSA-2026-1790666525 No score

TuxCare security update for org.springframework.data:spring-data-commons (3 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 3 CVEs. Fixed in 3.2.11-tuxcare.1.

Record: CLSA-2026-1790666525
Updated: 2026-11-02

OSVCLSA-2026-1790672048 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.5.11-tuxcare.1.

Record: CLSA-2026-1790672048
Updated: 2026-11-02

OSVCLSA-2026-1790673665 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.5.12-tuxcare.1.

Record: CLSA-2026-1790673665
Updated: 2026-11-02

OSVCLSA-2026-1790687278 No score

TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.0.12-tuxcare.1.

Record: CLSA-2026-1790687278
Updated: 2026-11-02

OSVCLSA-2026-1790691536 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 3.4.3-tuxcare.1.

Record: CLSA-2026-1790691536
Updated: 2026-11-02

OSVCLSA-2026-1790691700 No score

TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.0.11-tuxcare.1.

Record: CLSA-2026-1790691700
Updated: 2026-11-02

OSVCLSA-2026-1790696548 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 3.4.11-tuxcare.1.

Record: CLSA-2026-1790696548
Updated: 2026-11-02

OSVCLSA-2026-1790951905 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.7.16-tuxcare.2.

Record: CLSA-2026-1790951905
Updated: 2026-11-02

OSVCLSA-2026-1791192746 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.1.10.RELEASE-tuxcare.1.

Record: CLSA-2026-1791192746
Updated: 2026-11-02

OSVCLSA-2026-1792489414 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.4.9-tuxcare.3.

Record: CLSA-2026-1792489414
Updated: 2026-11-02

OSVCLSA-2026-1792489831 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.6.10-tuxcare.3.

Record: CLSA-2026-1792489831
Updated: 2026-11-02

OSVCLSA-2026-1793200289 No score

TuxCare security update for org.springframework.data:spring-data-commons (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 2 CVEs. Fixed in 2.3.5.RELEASE-tuxcare.1.

Record: CLSA-2026-1793200289
Updated: 2026-11-02

OSVCLSA-2026-1793950064 No score

TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 1.13.23.RELEASE-tuxcare.1.

Record: CLSA-2026-1793950064
Updated: 2026-11-06

OSVCLSA-2026-1793960711 No score

TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 2.1.5.RELEASE-tuxcare.1.

Record: CLSA-2026-1793960711
Updated: 2026-11-06

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.data:spring-data-commons` Maven	4.0.0 to 4.0.5	4.0.6
`org.springframework.data:spring-data-commons` Maven	3.5.0 to 3.5.11	3.5.12
`org.springframework.data:spring-data-commons` Maven	3.4.0 to 3.4.14	None known
`org.springframework.data:spring-data-commons` Maven	3.0.0 to 3.3.16	None known
`org.springframework.data:spring-data-commons` Maven	through 2.7.19	None known
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	2.7.18 up to 2.7.18-tuxcare.3, plus listed versions 2.7.18-tuxcare.22.7.18.tuxcare2.7.18.tuxcare.1	2.7.18-tuxcare.3
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 3 CVEs	3.3.13 up to 3.3.13-tuxcare.3, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.2	3.3.13-tuxcare.3
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	3.3.12 up to 3.3.12-tuxcare.1	3.3.12-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	3.4.13 up to 3.4.13-tuxcare.1	3.4.13-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 3 CVEs	3.2.12 up to 3.2.12-tuxcare.1	3.2.12-tuxcare.1

Show 24 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.data:spring-data-commons` TuxCare:Maven	3.1.8 up to 3.1.8-tuxcare.1	3.1.8-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	2.4.8 up to 2.4.8-tuxcare.1	2.4.8-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	3.4.12 up to 3.4.12-tuxcare.1	3.4.12-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	3.2.3 up to 3.2.3-tuxcare.1	3.2.3-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	2.7.14 up to 2.7.14-tuxcare.1	2.7.14-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 3 CVEs	3.2.11 up to 3.2.11-tuxcare.1	3.2.11-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	2.5.11 up to 2.5.11-tuxcare.1	2.5.11-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	2.5.12 up to 2.5.12-tuxcare.1	2.5.12-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven	3.0.12 up to 3.0.12-tuxcare.1	3.0.12-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	3.4.3 up to 3.4.3-tuxcare.1	3.4.3-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven	3.0.11 up to 3.0.11-tuxcare.1	3.0.11-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	3.4.11 up to 3.4.11-tuxcare.1	3.4.11-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	2.7.16 up to 2.7.16-tuxcare.2, plus listed versions 2.7.16-tuxcare.1	2.7.16-tuxcare.2
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	2.1.10.RELEASE up to 2.1.10.RELEASE-tuxcare.1	2.1.10.RELEASE-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	2.4.9 up to 2.4.9-tuxcare.3, plus listed versions 2.4.9-tuxcare.12.4.9-tuxcare.2	2.4.9-tuxcare.3
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	2.6.10 up to 2.6.10-tuxcare.3, plus listed versions 2.6.10-tuxcare.12.6.10-tuxcare.2	2.6.10-tuxcare.3
`org.springframework.data:spring-data-commons` TuxCare:Maven From an advisory covering 2 CVEs	2.3.5.RELEASE up to 2.3.5.RELEASE-tuxcare.1	2.3.5.RELEASE-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven	1.13.23.RELEASE up to 1.13.23.RELEASE-tuxcare.1	1.13.23.RELEASE-tuxcare.1
`org.springframework.data:spring-data-commons` TuxCare:Maven	2.1.5.RELEASE up to 2.1.5.RELEASE-tuxcare.1	2.1.5.RELEASE-tuxcare.1
`org.springframework.data:spring-data-commons` Maven	4.0.0 up to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5	4.0.6
`org.springframework.data:spring-data-commons` Maven	3.5.0 up to 3.5.12, plus listed versions 3.5.13.5.103.5.113.5.23.5.3 Show 6 moreShow less 3.5.43.5.53.5.63.5.73.5.83.5.9	3.5.12
`org.springframework.data:spring-data-commons` Maven	3.4.0 to 3.4.14, plus listed versions 3.4.13.4.103.4.113.4.123.4.13 Show 8 moreShow less 3.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.9	None known
`org.springframework.data:spring-data-commons` Maven	3.0.0 to 3.3.16, plus listed versions 3.0.13.0.103.0.113.0.123.0.2 Show 45 moreShow less 3.0.33.0.43.0.53.0.63.0.73.0.83.0.93.1.03.1.13.1.103.1.113.1.123.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2.03.2.13.2.103.2.113.2.123.2.23.2.33.2.43.2.53.2.63.2.73.2.83.2.93.3.03.3.13.3.103.3.113.3.123.3.133.3.23.3.33.3.43.3.53.3.63.3.7	None known
`org.springframework.data:spring-data-commons` Maven	through 2.7.19, plus listed versions 1.10.0.RELEASE1.10.1.RELEASE1.10.2.RELEASE1.11.0.RELEASE1.11.1.RELEASE Show 45 moreShow less 1.11.2.RELEASE1.11.4.RELEASE1.11.5.RELEASE1.11.6.RELEASE1.12.0.RELEASE1.12.1.RELEASE1.12.10.RELEASE1.12.11.RELEASE1.12.2.RELEASE1.12.3.RELEASE1.12.4.RELEASE1.12.5.RELEASE1.12.6.RELEASE1.12.7.RELEASE1.12.8.RELEASE1.12.9.RELEASE1.13.0.RELEASE1.13.1.RELEASE1.13.10.RELEASE1.13.11.RELEASE1.13.12.RELEASE1.13.13.RELEASE1.13.14.RELEASE1.13.15.RELEASE1.13.16.RELEASE1.13.17.RELEASE1.13.18.RELEASE1.13.2.RELEASE1.13.20.RELEASE1.13.21.RELEASE1.13.22.RELEASE1.13.23.RELEASE1.13.3.RELEASE1.13.4.RELEASE1.13.5.RELEASE1.13.6.RELEASE1.13.7.RELEASE1.13.8.RELEASE1.13.9.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.2.RELEASE1.5.3.RELEASE1.6.0.RELEASE1.6.1.RELEASE	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, aliases	OSV
Nov 6, 2026	affected, facts
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41711 is a medium vulnerability (CVSS 5.9) in Broadcom Spring Data Commons, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in org.springframework.data:spring-data-commons 4.0.6.

References

This page doesn't list everything

Left out here: 141 versions. The JSON record has them.