HIGH 7.5 GitHub
CVE-2026-41695
Spring Data: Unbounded property-path cache keyed by externally-supplied path string
`src/main/java/org/springframework/data/mapping/context/PersistentPropertyPathFactory.java:175` · Unbounded Resource Allocation (Algorithmic DoS)
### Impact
When a consuming module routes user-supplied dot-paths (sort parameters, projection paths, PATCH paths) through `MappingContext.getPersistentPropertyPath(String, Class)`, each distinct string — including invalid ones — is cached forever. A remote attacker can send millions of requests with unique `?sort=aaaa<n>` values and grow the heap un
Affected Products
- maven/org.springframework.data:spring-data-commons >= 4.0.0, <= 4.0.5
- maven/org.springframework.data:spring-data-commons >= 3.5.0, <= 3.5.11
- maven/org.springframework.data:spring-data-commons >= 3.4.0, <= 3.4.13
References
- https://github.com/advisories/GHSA-88fw-v6x4-3f58
- https://github.com/spring-projects/security-advisories/security/advisories/GHSA-88fw-v6x4-
- https://nvd.nist.gov/vuln/detail/CVE-2026-41695
- https://github.com/spring-projects/spring-data-commons/commit/96e9475b963218bb702959524187
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-07-31 via GitHub. Affected: maven/org.springframework.data:spring-data-commons >= 4.0.0, <= 4.0.5, maven/org.springframework.data:spring-data-commons >= 3.5.0, <= 3.5.11, maven/org.springframework.data:spring-data-commons >= 3.4.0, <= 3.4.13.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.