# CVE-2026-41695: VMware Spring Data Commons denial of service in MappingContext

Source: https://junglewise.ai/threats/cve-2026-41695-vmware-spring-data-commons-denial-of-service-in-mappingcontext  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-41695 · Severity: high · CVSS 7.5 · Published 2026-06-10

Spring Data Commons, a library used to simplify data access in Java applications, contains a flaw in how it handles certain database query parameters. An attacker can send a large number of specially crafted web requests that cause the application to consume all available memory. This leads to a denial-of-service (DoS) condition where the application crashes or becomes unresponsive, disrupting business operations.

Technologies: [org.springframework.data:spring-data-commons (Maven)](https://junglewise.ai/threats/technologies/org-springframework-data-spring-data-commons). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Spring](https://junglewise.ai/threats/vendors/spring).

## Quick answers

**Is CVE-2026-41695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41695 being exploited in the wild.

**How severe is CVE-2026-41695?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** org.springframework.data:spring-data-commons (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.6.

**Is there a fix for CVE-2026-41695?** Yes. org.springframework.data:spring-data-commons (Maven): upgrade to 4.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41695 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41695?** Check whether you run org.springframework.data:spring-data-commons (Maven) or Spring Data Commons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.data:spring-data-commons (Maven): upgrade to 4.0.6 or later

  ```sh
  # set org.springframework.data:spring-data-commons to 4.0.6 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in `PersistentPropertyPathFactory.java` where an unbounded `ConcurrentHashMap` is used to cache property paths. When `MappingContext.getPersistentPropertyPath` is called with user-supplied strings (such as sort or projection parameters), every unique string—including invalid ones—is stored in the cache indefinitely without eviction. A remote, unauthenticated attacker can exploit this by sending millions of requests with unique, random path strings, eventually exhausting the JVM heap and causing an OutOfMemoryError (OOM). The issue is particularly reachable when using Spring Data REST or store-specific query mappers that pass HTTP-derived strings directly to the mapping context. Patches have been released in versions 4.0.6 and 3.5.12.

## Affected products

- Spring spring-data-commons >= 4.0.0, <= 4.0.5
- Spring spring-data-commons >= 3.5.0, <= 3.5.11
- Spring spring-data-commons >= 3.4.0, <= 3.4.13

## Identifiers

- CVE-2026-41695
- GHSA-88fw-v6x4-3f58

## Timeline

- 2026-06-09: disclosed
- 2026-06-10: advisory: NVD publication date
- 2026-07-31: patched: GitHub Advisory reviewed and updated with patch versions

## References

- [https://github.com/spring-projects/security-advisories/security/advisories/GHSA-88fw-v6x4-3f58](https://github.com/spring-projects/security-advisories/security/advisories/GHSA-88fw-v6x4-3f58)
- [https://github.com/spring-projects/spring-data-commons/commit/96e9475b963218bb702959524187342671f6b080](https://github.com/spring-projects/spring-data-commons/commit/96e9475b963218bb702959524187342671f6b080)
- [https://github.com/spring-projects/spring-data-commons/commit/a4f893b66c18c70f2b22f29a2b55097b73c89941](https://github.com/spring-projects/spring-data-commons/commit/a4f893b66c18c70f2b22f29a2b55097b73c89941)
- [https://github.com/spring-projects/spring-data-commons/releases/tag/3.5.12](https://github.com/spring-projects/spring-data-commons/releases/tag/3.5.12)
- [https://github.com/spring-projects/spring-data-commons/releases/tag/4.0.6](https://github.com/spring-projects/spring-data-commons/releases/tag/4.0.6)

## Related threats

- [VMware Spring Data Commons denial of service in @ProjectedPayload](https://junglewise.ai/threats/cve-2026-41721-vmware-spring-data-commons-denial-of-service-in-projectedpayload)
- [VMware Spring Data heap exhaustion in property-lookup cache](https://junglewise.ai/threats/cve-2026-41716-vmware-spring-data-heap-exhaustion-in-property-lookup-cache)
- [VMware Spring Data Commons DoS in Sort parameter parsing](https://junglewise.ai/threats/cve-2026-41711-vmware-spring-data-commons-dos-in-sort-parameter-parsing)
- [Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation](https://junglewise.ai/threats/cve-2018-1274-spring-data-commons-contain-a-property-path-parser-vulnerability)
- [Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper…](https://junglewise.ai/threats/cve-2018-1259-spring-data-commons-used-in-combination-with-xmlbeam-contains-a)