CVE-2026-41716
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests.
Risk Assessment
An attacker can send a series of requests with unique crafted keys, leading to uncontrolled memory growth and heap exhaustion, causing denial of service (DoS) for the application.
Recommendation
Immediately update Spring Data Commons to version 2.7.20, 3.3.17, 3.4.15, 3.5.12, or 4.0.6, depending on the branch used, to remediate the vulnerability.
Original NVD description (English source)
Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustion through repeated requests. Affected versions: Spring Data Commons 2.7.0 through 2.7.19; 3.3.0 through 3.3.16; 3.4.0 through 3.4.14; 3.5.0 through 3.5.11; 4.0.0 through 4.0.5.