CVE-2026-41716

HighCVSS 7.5/10Last modified Jul 23, 2026

Description

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.

Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Spring	Spring Data Commons	>= 2.7.0, < 2.7.20; >= 3.3.0, < 3.3.17; >= 3.4.0, < 3.4.15; >= 3.5.0, < 3.5.11.1; >= 4.0.0, < 4.0.5.1

References

https://spring.io/security/cve-2026-41716Vendor Advisory

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-417178.1Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter bindi CVE-2026-417196.4A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method CVE-2026-41727.2A vulnerability was detected in TRENDnet TEW-632BRP 1.010B32. This affects an unknown part of the file /ping_response.cgi of the component H CVE-2026-417207.4Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an emp CVE-2026-417215.9Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in c CVE-2026-417225.4VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create CVE-2026-417238.0VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create CVE-2026-417245.4VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities.A malicious actor with privileges to create CVE-2026-417266.5When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique r CVE-2026-417276.5Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer coul CVE-2026-417287.5Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segme CVE-2026-417298.1Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+