Vulnerability details
CVE-2026-41695
Spring Data Commons
Denial of Service in Spring Data Commons Property Path Resolution
CVSS 3.1
7.5High
Official description
Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (vmware) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Spring | Spring Data Commons | 3.4.0 ≤ v < 3.4.15 | CVEProject cvelistV5 (CNA) |
| Spring | Spring Data Commons | 3.5.0 ≤ v < 3.5.11.1 | CVEProject cvelistV5 (CNA) |
| Spring | Spring Data Commons | 4.0.0 ≤ v < 4.0.5.1 | CVEProject cvelistV5 (CNA) |
References and advisories
1
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-06-10
- Last updated
- 2026-06-28
- State
- Published
- Assigner (CNA)
- vmware
Exploit prediction (EPSS)
0.36%
Probability of exploitation in 30 days
30.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-400Uncontrolled Resource Consumption