CVE-2026-41695

HighCVSS 7.5

Published: 10/06/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

A denial of service vulnerability in Spring Data Commons allows resource exhaustion via attacker-controlled property path strings in MappingContext resolution.

Risk Assessment

An attacker can cause application unavailability by overloading the server, potentially disrupting business operations.

Recommendation

Upgrade Spring Data Commons to version 4.0.6, 3.5.12, or 3.4.15, depending on your branch.

Original NVD description (English source)

Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution. Affected versions: Spring Data Commons 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14.