# CVE-2026-41716: VMware Spring Data heap exhaustion in property-lookup cache

Source: https://junglewise.ai/threats/cve-2026-41716-vmware-spring-data-heap-exhaustion-in-property-lookup-cache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-41716 · Severity: high · CVSS 7.5 · Published 2026-06-10

Spring Data Commons, a widely used library for managing data access in Java applications, contains a vulnerability in how it handles internal data caching. An attacker can send specially crafted requests that force the application to store an unlimited amount of data in its memory. Over time, this leads to memory exhaustion, causing the application to slow down significantly or crash entirely, resulting in a denial of service.

Technologies: [org.springframework.data:spring-data-commons (Maven)](https://junglewise.ai/threats/technologies/org-springframework-data-spring-data-commons). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-41716 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41716 being exploited in the wild.

**How severe is CVE-2026-41716?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** org.springframework.data:spring-data-commons (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.6.

**Is there a fix for CVE-2026-41716?** Yes. org.springframework.data:spring-data-commons (Maven): upgrade to 4.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41716 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41716?** Check whether you run org.springframework.data:spring-data-commons (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.data:spring-data-commons (Maven): upgrade to 4.0.6 or later

  ```sh
  # set org.springframework.data:spring-data-commons to 4.0.6 in your pom.xml or build.gradle
  ```


## Technical details

Spring Data Commons is vulnerable to a Denial of Service (DoS) via heap exhaustion (CWE-770). The vulnerability exists in the internal property-lookup cache, which fails to impose limits on the number or size of entries stored. A remote, unauthenticated attacker can supply crafted strings as cache keys through repeated network requests. Because these keys are retained permanently in the heap without throttling or eviction, the application eventually runs out of memory. The issue is resolved in versions 3.5.12 and 4.0.6.

## Affected products

- Spring Spring Data Commons 2.7.0 through 2.7.19, 3.3.0 through 3.3.16, 3.4.0 through 3.4.14, 3.5.0 through 3.5.11, 4.0.0 through 4.0.5

## Identifiers

- CVE-2026-41716
- GHSA-9fw2-h3hf-293r

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-08-12: patched

## References

- [https://spring.io/security/cve-2026-41716](https://spring.io/security/cve-2026-41716)
- [https://github.com/spring-projects/spring-data-commons/releases/tag/3.5.12](https://github.com/spring-projects/spring-data-commons/releases/tag/3.5.12)
- [https://github.com/spring-projects/spring-data-commons/releases/tag/4.0.6](https://github.com/spring-projects/spring-data-commons/releases/tag/4.0.6)

## Related threats

- [VMware Spring Data Commons denial of service in @ProjectedPayload](https://junglewise.ai/threats/cve-2026-41721-vmware-spring-data-commons-denial-of-service-in-projectedpayload)
- [VMware Spring Data Commons DoS in Sort parameter parsing](https://junglewise.ai/threats/cve-2026-41711-vmware-spring-data-commons-dos-in-sort-parameter-parsing)
- [VMware Spring Data Commons denial of service in MappingContext](https://junglewise.ai/threats/cve-2026-41695-vmware-spring-data-commons-denial-of-service-in-mappingcontext)
- [Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation](https://junglewise.ai/threats/cve-2018-1274-spring-data-commons-contain-a-property-path-parser-vulnerability)
- [Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper…](https://junglewise.ai/threats/cve-2018-1259-spring-data-commons-used-in-combination-with-xmlbeam-contains-a)