CVE-2026-41695: VMware Spring Data Commons denial of service in MappingContext

CVE-2026-41695 · Severity: high · CVSS 7.5 · Published 2026-06-10

Spring Data Commons, a library used to simplify data access in Java applications, contains a flaw in how it handles certain database query parameters. An attacker can send a large number of specially crafted web requests that cause the application to consume all available memory. This leads to a denial-of-service (DoS) condition where the application crashes or becomes unresponsive, disrupting business operations.

Technologies: org.springframework.data:spring-data-commons (Maven). Vendors: Maven, Spring.

Quick answers

Is CVE-2026-41695 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41695 being exploited in the wild.
How severe is CVE-2026-41695?
High severity, with a CVSS score of 7.5, published 10 June 2026.
Which products and versions are affected?
org.springframework.data:spring-data-commons (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.6.
Is there a fix for CVE-2026-41695?
Yes. org.springframework.data:spring-data-commons (Maven): upgrade to 4.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41695 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41695?
Check whether you run org.springframework.data:spring-data-commons (Maven) or Spring Data Commons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.data:spring-data-commons (Maven): upgrade to 4.0.6 or later
    # set org.springframework.data:spring-data-commons to 4.0.6 in your pom.xml or build.gradle

Technical details

The vulnerability exists in `PersistentPropertyPathFactory.java` where an unbounded `ConcurrentHashMap` is used to cache property paths. When `MappingContext.getPersistentPropertyPath` is called with user-supplied strings (such as sort or projection parameters), every unique string—including invalid ones—is stored in the cache indefinitely without eviction. A remote, unauthenticated attacker can exploit this by sending millions of requests with unique, random path strings, eventually exhausting the JVM heap and causing an OutOfMemoryError (OOM). The issue is particularly reachable when using Spring Data REST or store-specific query mappers that pass HTTP-derived strings directly to the mapping context. Patches have been released in versions 4.0.6 and 3.5.12.

Affected products

  • Spring spring-data-commons >= 4.0.0, <= 4.0.5
  • Spring spring-data-commons >= 3.5.0, <= 3.5.11
  • Spring spring-data-commons >= 3.4.0, <= 3.4.13

Identifiers

  • CVE-2026-41695
  • GHSA-88fw-v6x4-3f58

Timeline

  • 2026-06-09: disclosed
  • 2026-06-10: advisory: NVD publication date
  • 2026-07-31: patched: GitHub Advisory reviewed and updated with patch versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.