Executive brief
Spring Data Commons is a widely used library for managing data access in Java applications. A vulnerability exists where processing specifically crafted sorting requests can cause the application to crash due to a memory error. This allows an attacker to disrupt the availability of the service, potentially leading to a complete system outage.
Technical details
A Denial of Service (DoS) vulnerability exists in Spring Data Commons due to uncontrolled resource consumption (CWE-400) during the parsing of 'Sort' parameters. An attacker can provide specially crafted input that triggers a StackOverflowException, causing the Java Virtual Machine (JVM) thread to fail and potentially exhausting application resources. The attack is reachable over the network and requires no specific privileges, though it is rated with high attack complexity. Patches have been released in versions 4.0.6 and 3.5.12 to address this issue.
Affected products
- Spring Spring Data Commons 4.0.0 to 4.0.5, 3.5.0 to 3.5.11, 3.4.0 to 3.4.14, 3.3.0 to 3.3.16, 3.2.0 to 3.2.15, 3.1.0 to 3.1.14, 3.0.0 to 3.0.15, 2.7.0 to 2.7.19
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-06-09: patched: Versions 4.0.6 and 3.5.12 released