{"id":"CVE-2026-41716","aliases":["CLSA-2025-1755561852","CLSA-2026-1788348838","CLSA-2026-1791466221","CLSA-2026-1792426869","CLSA-2026-1792658485","CLSA-2026-1792664608","CLSA-2026-1793183291","CLSA-2026-1793886224","EUVD-2026-35899","GHSA-9fw2-h3hf-293r","ROOT-APP-MAVEN-CVE-2026-41716"],"status":"published","title":"Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names","description":"Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.\n\nAffected versions:\nSpring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00363,"percentile":0.30457,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-06-09T23:48:20Z","modified":"2026-11-06T13:15:13Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","fixed_in":["4.0.6","3.5.12"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-commons","fixed_in":["2.7.18-tuxcare.8","3.3.13-tuxcare.8","3.3.12-tuxcare.3","3.1.8-tuxcare.3","3.0.12-tuxcare.2","3.2.12-tuxcare.2","3.4.3-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.data:spring-data-commons","fixed_in":["4.0.5-aikido.2","2.7.2-aikido.1","3.5.11-aikido.1","3.5.10-aikido.2","3.3.5-aikido.1","4.0.4-aikido.1","4.0.5-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.data:spring-data-commons","fixed_in":["4.0.5-root.io.2","2.7.2-root.io.1","3.5.11-root.io.1","3.5.10-root.io.2","3.3.5-root.io.1","4.0.4-root.io.1","4.0.5-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.0.5"},{"fixed":"4.0.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"last_affected":"3.5.11"},{"fixed":"3.5.12"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"last_affected":"3.4.14"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"last_affected":"3.3.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.19"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.18"},{"fixed":"2.7.18-tuxcare.8"}]}],"versions":["2.7.18","2.7.18-tuxcare.2","2.7.18-tuxcare.3","2.7.18-tuxcare.4","2.7.18-tuxcare.5","2.7.18-tuxcare.6","2.7.18-tuxcare.7","2.7.18.tuxcare","2.7.18.tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.13"},{"fixed":"3.3.13-tuxcare.8"}]}],"versions":["3.3.13","3.3.13-tuxcare.1","3.3.13-tuxcare.2","3.3.13-tuxcare.3","3.3.13-tuxcare.4","3.3.13-tuxcare.5","3.3.13-tuxcare.6","3.3.13-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.12"},{"fixed":"3.3.12-tuxcare.3"}]}],"versions":["3.3.12","3.3.12-tuxcare.1","3.3.12-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.8"},{"fixed":"3.1.8-tuxcare.3"}]}],"versions":["3.1.8","3.1.8-tuxcare.1","3.1.8-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.12"},{"fixed":"3.0.12-tuxcare.2"}]}],"versions":["3.0.12","3.0.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.12"},{"fixed":"3.2.12-tuxcare.2"}]}],"versions":["3.2.12","3.2.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.3"},{"fixed":"3.4.3-tuxcare.2"}]}],"versions":["3.4.3","3.4.3-tuxcare.1"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.0.6"}]}],"versions":["4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0"},{"fixed":"3.5.12"}]}],"versions":["3.5.0","3.5.1","3.5.10","3.5.11","3.5.2","3.5.3","3.5.4","3.5.5","3.5.6","3.5.7","3.5.8","3.5.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.0"},{"last_affected":"3.4.14"}]}],"versions":["3.4.0","3.4.1","3.4.10","3.4.11","3.4.12","3.4.13","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.4.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"last_affected":"3.3.16"}]}],"versions":["3.3.0","3.3.1","3.3.10","3.3.11","3.3.12","3.3.13","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.3.8","3.3.9"]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.19"}]}],"versions":["1.10.0.RELEASE","1.10.1.RELEASE","1.10.2.RELEASE","1.11.0.RELEASE","1.11.1.RELEASE","1.11.2.RELEASE","1.11.4.RELEASE","1.11.5.RELEASE","1.11.6.RELEASE","1.12.0.RELEASE","1.12.1.RELEASE","1.12.10.RELEASE","1.12.11.RELEASE","1.12.2.RELEASE","1.12.3.RELEASE","1.12.4.RELEASE","1.12.5.RELEASE","1.12.6.RELEASE","1.12.7.RELEASE","1.12.8.RELEASE","1.12.9.RELEASE","1.13.0.RELEASE","1.13.1.RELEASE","1.13.10.RELEASE","1.13.11.RELEASE","1.13.12.RELEASE","1.13.13.RELEASE","1.13.14.RELEASE","1.13.15.RELEASE","1.13.16.RELEASE","1.13.17.RELEASE","1.13.18.RELEASE","1.13.2.RELEASE","1.13.20.RELEASE","1.13.21.RELEASE","1.13.22.RELEASE","1.13.23.RELEASE","1.13.3.RELEASE","1.13.4.RELEASE","1.13.5.RELEASE","1.13.6.RELEASE","1.13.7.RELEASE","1.13.8.RELEASE","1.13.9.RELEASE","1.5.0.RELEASE","1.5.1.RELEASE","1.5.2.RELEASE","1.5.3.RELEASE","1.6.0.RELEASE","1.6.1.RELEASE","1.6.2.RELEASE","1.6.3.RELEASE","1.6.4.RELEASE","1.6.5.RELEASE","1.7.0.RELEASE","1.7.1.RELEASE","1.7.2.RELEASE","1.7.3.RELEASE","1.8.0.RELEASE","1.8.1.RELEASE","1.8.2.RELEASE","1.8.4.RELEASE","1.8.5.RELEASE","1.8.6.RELEASE","1.9.0.RELEASE","1.9.1.RELEASE","1.9.2.RELEASE","1.9.3.RELEASE","1.9.4.RELEASE","2.0.0.RELEASE","2.0.1.RELEASE","2.0.10.RELEASE","2.0.11.RELEASE","2.0.12.RELEASE","2.0.13.RELEASE","2.0.14.RELEASE","2.0.2.RELEASE","2.0.3.RELEASE","2.0.4.RELEASE","2.0.5.RELEASE","2.0.6.RELEASE","2.0.7.RELEASE","2.0.8.RELEASE","2.0.9.RELEASE","2.1.0.RELEASE","2.1.1.RELEASE","2.1.10.RELEASE","2.1.11.RELEASE","2.1.12.RELEASE","2.1.13.RELEASE","2.1.14.RELEASE","2.1.15.RELEASE","2.1.16.RELEASE","2.1.17.RELEASE","2.1.18.RELEASE","2.1.19.RELEASE","2.1.2.RELEASE","2.1.20.RELEASE","2.1.21.RELEASE","2.1.3.RELEASE","2.1.4.RELEASE","2.1.5.RELEASE","2.1.6.RELEASE","2.1.7.RELEASE","2.1.8.RELEASE","2.1.9.RELEASE","2.2.0.RELEASE","2.2.1.RELEASE","2.2.10.RELEASE","2.2.11.RELEASE","2.2.12.RELEASE","2.2.13.RELEASE","2.2.2.RELEASE","2.2.3.RELEASE","2.2.4.RELEASE","2.2.5.RELEASE","2.2.6.RELEASE","2.2.7.RELEASE","2.2.8.RELEASE","2.2.9.RELEASE","2.3.0.RELEASE","2.3.1.RELEASE","2.3.2.RELEASE","2.3.3.RELEASE","2.3.4.RELEASE","2.3.5.RELEASE","2.3.6.RELEASE","2.3.7.RELEASE","2.3.8.RELEASE","2.3.9.RELEASE","2.4.0","2.4.1","2.4.10","2.4.11","2.4.12","2.4.13","2.4.14","2.4.15","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.5.0","2.5.1","2.5.10","2.5.11","2.5.12","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.5.9","2.6.0","2.6.1","2.6.10","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","2.7.0","2.7.1","2.7.10","2.7.11","2.7.12","2.7.13","2.7.14","2.7.15","2.7.16","2.7.17","2.7.18","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-aikido.2"},{"fixed":"2.7.2-aikido.1"},{"fixed":"3.5.11-aikido.1"},{"fixed":"3.5.10-aikido.2"},{"fixed":"3.3.5-aikido.1"},{"fixed":"4.0.4-aikido.1"},{"fixed":"4.0.5-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.data:spring-data-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.5-root.io.2"},{"fixed":"2.7.2-root.io.1"},{"fixed":"3.5.11-root.io.1"},{"fixed":"3.5.10-root.io.2"},{"fixed":"3.3.5-root.io.1"},{"fixed":"4.0.4-root.io.1"},{"fixed":"4.0.5-root.io.1"}]}]}],"products":[{"vendor":"broadcom","product":"spring_data_commons"},{"vendor":"pivotal","product":"spring data commons"},{"vendor":"spring","product":"spring data commons"}],"references":[{"url":"https://spring.io/security/cve-2026-41716","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41716","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-data-commons/releases/tag/3.5.12","tags":["web"]},{"url":"https://github.com/spring-projects/spring-data-commons/releases/tag/4.0.6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9fw2-h3hf-293r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41716.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-data-commons","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-41716","title":"Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names","description":"Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.\n\nAffected versions:\nSpring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.","status":"published","published":"2026-06-09T23:48:20.282Z","modified":"2026-06-30T21:39:45.337Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:41:08.498858Z"}],"euvd":[{"id":"EUVD-2026-35899","description":"Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.\n\nAffected versions:\nSpring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.","status":"published","published":"2026-06-09T23:48:20Z","modified":"2026-06-30T21:39:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:21.147551Z"}],"ghsa":[{"id":"GHSA-9fw2-h3hf-293r","title":"Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys","description":"Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.\n\nAffected versions:\nSpring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.","status":"published","published":"2026-06-10T00:31:51Z","modified":"2026-08-12T16:10:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:58.888637Z"}],"nvd":[{"id":"CVE-2026-41716","description":"Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.\n\nAffected versions:\nSpring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.","status":"published","published":"2026-06-10T00:16:51.567Z","modified":"2026-07-23T09:10:00.113Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"CVE-2026-41716","title":"Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names","description":"Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.\n\nAffected versions:\nSpring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.","status":"published","published":"2026-06-09T23:48:20.282Z","modified":"2026-10-28T02:30:23.093749263Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"GHSA-9fw2-h3hf-293r","title":"Spring Data Commons: Heap exhaustion from unbounded property-lookup cache retaining crafted string keys","description":"Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.\n\nAffected versions:\nSpring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.","status":"published","published":"2026-06-10T00:31:51Z","modified":"2026-09-10T03:50:49.419423072Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"CLSA-2025-1755561852","title":"TuxCare security update for org.springframework.boot (1 CVE)","description":"TuxCare rebuilt 76 org.springframework.boot packages to address 1 CVE. Fixed in 2.7.18-tuxcare.8.","status":"withdrawn","published":"2026-08-04T14:52:04Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CLSA-2026-1788348838","title":"TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 2.7.18-tuxcare.8.","status":"published","published":"2026-09-02T11:33:58Z","modified":"2026-10-15T09:45:24.856749342Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1791466221","title":"TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.13-tuxcare.8.","status":"published","published":"2026-10-08T13:30:21Z","modified":"2026-10-15T09:45:38.046230991Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792426869","title":"TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.3.12-tuxcare.3.","status":"published","published":"2026-10-19T16:21:09Z","modified":"2026-10-19T19:15:04.94943159Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792658485","title":"TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.1.8-tuxcare.3.","status":"published","published":"2026-10-22T08:41:25Z","modified":"2026-10-22T14:15:02.629824053Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792664608","title":"TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.0.12-tuxcare.2.","status":"published","published":"2026-10-22T10:23:28Z","modified":"2026-10-22T14:15:03.655578357Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793183291","title":"TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.2.12-tuxcare.2.","status":"published","published":"2026-10-28T10:28:11Z","modified":"2026-10-28T13:45:03.599381094Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793886224","title":"TuxCare security update for org.springframework.data:spring-data-commons (1 CVE)","description":"TuxCare rebuilt org.springframework.data:spring-data-commons to address 1 CVE. Fixed in 3.4.3-tuxcare.2.","status":"published","published":"2026-11-05T14:43:44Z","modified":"2026-11-06T13:15:13.428866556Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-41716","title":"CVE-2026-41716 in org.springframework.data:spring-data-commons - Patched by Root","description":"Root has patched CVE-2026-41716 in the org.springframework.data:spring-data-commons package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-18T08:23:48Z","modified":"2026-09-18T09:15:03.648476465Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}