Executive brief
Spring Data Commons, a widely used library for managing data access in Java applications, is vulnerable to a Denial of Service (DoS) attack. If an application uses specific web support features (specifically @ProjectedPayload), an attacker can send a malicious request that forces the server to consume excessive amounts of memory. This can lead to application crashes or severe performance degradation, effectively making the service unavailable to legitimate users.
Technical details
A resource exhaustion vulnerability (CWE-400) exists in Spring Data Commons due to improper memory allocation during projection binding. The issue occurs when Spring Data Web Support is enabled and a Controller method utilizes the @ProjectedPayload annotation. An unauthenticated remote attacker can exploit this by sending a specially crafted HTTP request designed to trigger excessive memory allocation. This results in a Denial of Service (DoS) via memory exhaustion. The attack complexity is rated as high, likely due to the specific configuration requirements. Patches have been released in versions 4.0.6 and 3.5.12.
Affected products
- Spring Spring Data Commons 4.0.0 to 4.0.5, 3.5.0 to 3.5.11, 3.4.0 to 3.4.14, 3.3.0 to 3.3.16, 3.2.0 to 3.2.15, 3.1.0 to 3.1.14, 3.0.0 to 3.0.15, 2.7.0 to 2.7.19
Timeline
- 2026-06-09: patched: Release 3.5.12 tagged
- 2026-06-10: disclosed: NVD and GitHub Advisory published
- 2026-08-12: advisory: GitHub Advisory updated