Vulnerability Directory | CVE-2026-41716

Overview

Spring Data Commons is the foundational module of the Spring Data project, providing shared infrastructure (repositories, mapping metadata, property-path resolution, and web integration) used transitively by every Spring Data store module such as Spring Data JPA, MongoDB, and Redis.

A high-severity vulnerability, CVE-2026-41716, has been identified in Spring Data Commons. An internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys. By repeatedly sending requests that carry distinct property-name strings, including ones that do not resolve to any real property, an unauthenticated remote attacker can cause the cache to grow without bound until the JVM exhausts its heap and throws an OutOfMemoryError, denying service to the application.

Per OWASP, a denial of service attack aims to make a resource unavailable to its legitimate users, for example by exhausting memory, processing, or storage so the application can no longer respond to valid requests.

This issue affects versions >=2.5.0 <=2.5.12, >=2.7.0 <=2.7.19, >=3.2.0 <=3.2.12, >=3.3.0 <=3.3.16, >=3.4.0 <=3.4.14, >=3.5.0 <=3.5.11, and >=4.0.0 <=4.0.5 of Spring Data Commons. Versions that are no longer supported are also affected.

‍

Details

Module Info

Product: Spring Data Commons
Affected packages: spring-data-commons
Affected versions: >=2.5.0 <=2.5.12, >=2.7.0 <=2.7.19, >=3.2.0 <=3.2.12, >=3.3.0 <=3.3.16, >=3.4.0 <=3.4.14, >=3.5.0 <=3.5.11, >=4.0.0 <=4.0.5
GitHub repository: https://github.com/spring-projects/spring-data-commons
Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-commons
Package manager: maven
Fixed in:
NES for Spring Data Commons
Spring Data Commons 4.0.6, 3.5.12 (OSS)

Vulnerability Info

Spring Data Commons models the properties of every domain, projection, and parameter type through TypeInformation objects backed by the TypeDiscoverer class. Whenever Spring Data resolves a property name against a type, for example while handling web requests whose sort, filter, binding, or projection parameters carry property names, the lookup lands in TypeDiscoverer.getProperty(String name).

Each TypeDiscoverer instance keeps a per-type property cache that is an unbounded ConcurrentHashMap populated with computeIfAbsent. Every distinct name ever queried is interned into the cache, including names that do not resolve to any real property of the type, which are retained forever as empty entries:

private final Map<String, Optional<TypeInformation<?>>> fields = new ConcurrentHashMap<>();

public TypeInformation<?> getProperty(String name) {
    // ...
    return fields.computeIfAbsent(name, this::getPropertyInformation).orElse(null);
}

Because the queried name is attacker-controlled and the cache has no capacity limit or eviction policy, an attacker can drive unbounded heap growth simply by issuing many requests with unique property-name strings. The cache behaves as a negative-result cache: a name that fails to resolve to a real property still consumes a permanent cache slot. Sustained over enough requests, this exhausts available heap and renders the application unavailable. The remediation replaces the per-name cache with a fixed-size map of the type's actual properties, computed once in a single pass over the type's declared fields and property descriptors, so unknown names are simply looked up and never stored.

This vulnerability has been present since at least Spring Data Commons 2.5 and likely earlier.

‍

Mitigation

Spring Data Commons versions in the affected ranges that are End-of-Life will not receive public OSS patches for this issue; the 2.5.x, 2.7.x, 3.2.x, 3.3.x, and 3.4.x lines have no publicly available fix, and applying unofficial patches yourself is not recommended. The fix for this issue is available in HeroDevs Never-Ending Support (NES) for Spring Data Commons on all five of those lines.

To remediate this vulnerability, the recommended actions are:

Upgrade to a supported, fixed version of Spring Data Commons (3.5.12 or 4.0.6 for the OSS lines).
For applications that must remain on an end-of-life line, use HeroDevs Never-Ending Support (NES) for Spring Data Commons, which provides a drop-in patched build without forcing a major upgrade. Learn more about HeroDevs Never-Ending Support for Spring Data Commons and request coverage.

‍